Sophos Gateway Manager UTM Manager Administration guide
Sophos UTM Manager Gateway Manager allows you to remotely monitor and manage multiple Sophos UTM appliances, gateways, and firewalls. It provides a central point of control for managing security policies, updating firmware, and troubleshooting issues.
Advertisement
Advertisement
Sophos UTM Manager administration guide for gateway manager
Product version:
4.200
Document date:
Tuesday, May 06, 2014
The specifications and information in this document are subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. This document may not be copied or distributed by any means, in whole or in part, for any reason, without the express written permission of Sophos Limited. Translations of this original manual must be marked as follows: "Translation of the original manual".
© 2014 Sophos Limited. All rights reserved.
http://www.sophos.com
Sophos UTM, Sophos UTM Manager, Astaro Security Gateway, Astaro Command Center, Astaro
Gateway Manager, and WebAdmin are trademarks of Sophos Limited. Cisco is a registered trademark of Cisco Systems Inc. iOS is a trademark of Apple Inc. Linux is a trademark of Linus Torvalds. All further trademarks are the property of their respective owners.
Limited Warranty
No guarantee is given for the correctness of the information contained in this document. Please send any comments or corrections to [email protected].
Contents
2.2 Configuring Local Gateway Unit Serving as Firewall
2.2.1 Preparing Connection to the SUM Server
2.2.2 Selecting the SUM Server
2.2.3 Enabling Communication Between Remote Gateway Units and SUM Server 9
2.3 Configuring Remote Sophos Gateway Unit 11
2.3.1 Preparing Connection to the SUM Server
2.3.2 Selecting the SUM Server
3.5 Page Actions and Control Panels
Contents iv
5.1.1 Device Inventory Details
6.1.2 Editing Device Information
6.3.1 Creating Organizational Units
6.3.2 The Global Organizational Unit
7.1.3.1 Deploying Global Objects
7.1.3.2 Removing Global Objects
7.1.3.3 Deleting Global Objects
SUM V4 Gateway Manager
7.6.2 URL Filtering Categories
SUM V4 Gateway Manager
Contents
v
Contents
vi
SUM V4 Gateway Manager
1 Foreword
Sophos UTM Manager (hereinafter simply referred to as SUM) is Sophos' central management product, which provides useful features such as monitoring, configuration, maintenance, inventory, and the possibility of multiple administrators.
Get in control of all your Sophos gateway software and appliance installations worldwide instantly. Just install SUM, connect your Sophos gateway at SUM and you are done. SUM offers the same intuitive web-based GUI as known from all other Sophos products.
Right from the start it helps you monitor the availability of each installation as well as its health status. When using the Dashboard view you can monitor up to 250 devices simultaneously.
SUM is intended to provide a general overview of the state of each Sophos gateway appliance or software firewall, their version, current load, license expiration, and critical security events.
The information is accessible via a graphical web-based GUI providing you with various view options for all monitored devices.
Managing more than 100 network devices can be quite a challenge: just to know where each device is located and to find the appropriate one when needed. SUM includes an inventory system that automatically keeps track of each device. Based on the inventory and customer information an intuitive selection box helps you display the relevant devices only.
To manage a set of specific devices through the GUI, they can be selected from various tree views. These tree views group devices by country, model, or version. Depending on the selected view option (Dashboard or tabular), the most relevant information for all selected devices will be displayed at a glance.
Moreover, you can even assign various administration roles to registered users, which amounts to the possibility of multiple administrators. This makes SUM perfectly suited for partners and
MSSPs.
This documentation will take you step-by-step through the installation process of Sophos UTM
Manager. Additionally, the documentation explains in details the Sophos UTM Manager Gateway Manager, which is an integration part of the SUM product. This web-based graphical user interface (GUI) is dedicated to all monitoring, maintenance, and management activities for all kind of Sophos gateway products. You can download the SUM Gateway Manager Administration Guide from the SUM WebAdmin online help, on tab Support > Documentation.
2 First Steps
This chapter describes the necessary steps to take for Gateway Manager setup.
Setting up a Sophos Management Network includes both the configuration of Sophos UTM
Manager and the Sophos gateway units monitored by it—the term Sophos gateway unit comprises Sophos UTM, Sophos Security Gateway, Sophos Web Gateway, and Sophos Mail Gateway. If the Sophos UTM Manager server is located behind a firewall, the communication between Sophos UTM Manager and remote Sophos gateway units must explicitly be allowed on that firewall.
HTTPS
WebAdmin
Port 4444
Port 4433
Port 4422
Gateway Manager
Sophos UTM Manager
IP Address 192.168.2.200
Partner/Service Provider or Headquarter
Sophos UTM
(UTM01)
Port 4433
Ext. IP Address 65.227.28.232
Sophos UTM
(UTM02)
Sophos UTM
(UTM03)
Sophos UTM
(UTM04)
Sophos UTM
(UTM05)
Sophos UTM
(UTM06)
Sophos UTM
(UTM07)
Sophos UTM
(UTM08)
Customer/Office 1 Customer/Office 2
Figure 1 First Steps: Sophos Management Network
The configuration of the Sophos Management Network is illustrated in the diagram above. The following steps are necessary for setting up a Sophos Management Network:
4
2.1 Preparing SUM Server
2 First Steps
1.
Preparing the Sophos UTM Manager server.
2.
Configuring the local Sophos gateway, for example a Sophos UTM unit (UTM 01). As this Sophos gateway serves as a firewall between the SUM server and the remote gateways, you have to enable the respective communication explicitly.
3.
Configuring the remote Sophos gateways, for example Sophos UTM units (UTM 02-08).
Note – Once the necessary settings for the administration via Sophos UTM Manager have been made on the Sophos gateway, this gateway unit connects to the Sophos UTM Manager server. For that purpose, enable Sophos UTM Manager first and allow on the local Sophos gateway (UTM 01) the communication between the SUM unit and the remote Sophos gateway units (UTM 02-08).
2.1 Preparing SUM Server
Sophos UTM Manager must be enabled and available for the Sophos gateway units. Then the security systems will automatically establish a connection to SUM. This ensures that also those systems can be administered that do not have a fixed IP address.
The configuration tool of SUM (WebAdmin interface) can be accessed through any client in the network.
1.
Start the browser and enter the IP address of SUM's WebAdmin interface.
This is the IP address configured for the administrative network interface. To stick with the example above, this would be https://192.168.2.200:4444.
The Basic System Setup page appears.
2.
Fill in the information of your organization.
3.
Create a password for the administrator of SUM.
Within SUM, the administrator is referred to as admin.
4.
Provide the administrator's email account.
This account will be used to send system notifications and reports.
SUM V4 Gateway Manager
2 First Steps
2.1 Preparing SUM Server
Figure 2 First Steps: Initial Login Page of SUM WebAdmin
The Basic System Setup page also contains the End User License Agreement. Please read the license carefully and select I accept the license agreement if you agree to the terms of use. Click
Perform Basic System Setup to complete initialization. This operation needs about 40 seconds to complete. After the initial setup is completed the WebAdmin login page will appear. Please log in as admin using the just created password.
Once logged in, navigate to SUM (WebAdmin interface) Management > Sophos UTM Manager and select the Device Security tab. Here you should provide allowed networks. Only devices with IPs from these networks will be permitted to register to SUM. Another security mechanism, configurable for this tab, is the shared secret authentication method used to establish a connection between Sophos gateways and SUM. If you selected to use a shared secret authentication, the administrator of the remote endpoint should use the same shared secret password when configuring Central Management settings. Ensure you accurately and securely distribute the shared secret to the administrator of the remote endpoint if you do not make the settings yourself.
Newly registered Sophos gateway units will be displayed on SUM (Gateway Manager interface) Management > Registration page. By default, all Sophos gateways connected to SUM are allowed and can thus be monitored and administered in the Monitoring and Management pages.
SUM V4 Gateway Manager
5
6
2.2 Configuring Local Gateway Unit Serving as Firewall
2 First Steps
As next step, configure the Gateway Manager access policy. The access policy is based on allowed users or groups, and allowed networks.
1.
Create users and groups in the Definitions & Users > Users & Groups menu.
The users and groups are authorized as Gateway Manager users.
2.
Create networks on the Definitions & Users > Network Definitions menu.
These are the networks you would like to allow access from.
3.
Provide allowed networks in Management > Sophos UTM Manager > Access
Control.
4.
Add created users/groups into the Allowed Admins and Allowed Users boxes.
Note – Allowed Users privileges, which are related to functions and roles within the
Gateway Manager interface, are managed using the Gateway Manager interface menu Management > Access Control.
SUM server basic preparation is completed.
2.2 Configuring Local Gateway Unit
Serving as Firewall
Open the WebAdmin of the local Sophos gateway unit (UTM 01 in our
To configure the Sophos gateway unit, proceed as follows:
1.
Preparing Connection to the SUM Server
2.
3.
Enabling Communication Between Remote Gateway Units and SUM Server
2.2.1 Preparing Connection to the SUM Server
To connect the security system to the SUM server, the SUM server must first be defined on the
WebAdmin interface of the local gateway unit (UTM 01 in our
1.
On the Definitions & Users > Network Definitions page, click New Network
Definition.
The Create New Network Definition dialog box opens.
SUM V4 Gateway Manager
2 First Steps
2.2 Configuring Local Gateway Unit Serving as Firewall
2.
Make the following settings:
Name: Enter the name of the server (e.g., SUM Server).
Type: Set the network type (e.g., Host).
IPv4 address: Enter the IPv4 address of the SUM server (example: 192.168.2.200).
Comment (optional): Add a description or other information.
3.
Click Save.
The server will be added to the Network Definitions list.
Figure 3 First Steps: Creating SUM Server
2.2.2 Selecting the SUM Server
Now you need to select the defined SUM server. In the Management > Central Management menu of the local gateway unit's WebAdmin interface (UTM 01 in our
lows:
1.
On the Sophos UTM Manager tab, enable SUM.
Click the toggle switch.
The toggle switch turns amber and the SUM Settings area becomes editable.
2.
Specify the SUM host.
Select or add the SUM server UTM should connect to.
l
Authentication (optional): If the SUM server requires authentication, select this option and enter the same password (shared secret) as configured on the SUM server.
SUM V4 Gateway Manager
7
2.2 Configuring Local Gateway Unit Serving as Firewall
2 First Steps
l
Use SUM server as Up2Date cache (optional): Up2Date packages can be fetched from a cache located on the SUM server. If you want to use this functionality for your gateway, select the option Use SUM server as Up2Date cache.
Please ensure that on your managing SUM server the Up2Date cache functionality is enabled accordingly. Note that usage of the Up2Date cache functionality is mutually exclusive with using a parent proxy configuration for Up2Dates.
3.
Define the rights of the SUM administrator.
On SUM, the administrator responsible for this UTM can only administer those areas of your UTM which are explicitly allowed to be administered here. The rights listed here correspond to the SUM Gateway Manager main menu and administrative options.
Administration: If selected, the administrator can use all features located in the Main-
tenance and Management menus. He can, for example, view the inventory, create and restore backups, and schedule actions like firmware updates.
Reporting: If selected, the administrator can use all features located in the Reporting menu. He can, for example, request reports from UTM.
Monitoring: If selected, UTM will be displayed on the Monitoring pages and the administrator can use all associated features.
Configuration: If selected, the administrator can use all features located in the Con-
figuration menu. He can, for example, deploy objects (networks, hosts, VPNs) to UTM.
4.
Click Apply.
Your settings will be saved.
UTM will now try to establish a connection to Sophos UTM Manager. Once the connection between both systems is established, the connection status will turn green. Then
UTM can be monitored and administered by the SUM server selected here. You will be able to see the current connection status and health in the SUM Health section. Reloading the page will update this data. Please use the Open Live Log button and read carefully the messages from the message board to be able to diagnose connection problems should they occur.
Note – The communication between the Sophos gateway unit and SUM takes place on port
4433
, whereas Sophos UTM Manager can be accessed through a browser via the HTTPS protocol on port 4444 for the WebAdmin and on port 4422 for the Gateway Manager interface.
8
SUM V4 Gateway Manager
2 First Steps
2.2 Configuring Local Gateway Unit Serving as Firewall
You can always disable the connection to the SUM server by clicking Disable. This will also allow you to access a manual Cleanup Objects button, should a need arise to remove SUM-created objects on a particular device. This functionality is available starting with V7.4 of the gateway product line. Further information can be found in the Configuration >
section or the documentation for the Management > Central Management settings of the respective device.
2.2.3 Enabling Communication Between Remote
Gateway Units and SUM Server
After that, communication between remote Sophos gateway units in the public network (UTM
02-08 in our
) and the SUM server must be enabled on the local gateway unit (UTM 01 in our
), which serves as a firewall between the Internet and the private network. Proceed as follows:
1.
On the WebAdmin interface of the local gateway unit, configure the network settings.
Go to the Definitions & Users > Service Definitions page and define the following service:
Name: Enter the name for the service (e.g., Sophos UTM Manager).
Type of definition: Select TCP.
Destination port: Enter 4433.
Source port: Keep the setting 1:65535.
Comment (optional): Add a description or other information.
SUM V4 Gateway Manager
Figure 4 First Steps: New Service Definition
9
2.2 Configuring Local Gateway Unit Serving as Firewall
2 First Steps
2.
Click Save to complete the definition.
The new service definition appears on the Service Definition table.
3.
Define a NAT rule.
Open the Network Protection > NAT > NAT tab and create the following DNAT rule:
Position: Select Bottom.
Rule type: Select DNAT (Destination).
For traffic from: Select Any for the example.
Using service: Select the service you have defined above (e.g.,
Sophos UTM Manager).
Going to: Select the external network card (e.g., External (Address)).
Change the destination to: Select the SUM server (e.g., SUM Server).
And the service to: Leave this field blank.
Automatic firewall rule: Ensure that this box is checked.
Comment (optional): Add a description or other information.
10
Figure 5 First Steps: New DNAT Rule
SUM V4 Gateway Manager
2 First Steps
2.3 Configuring Remote Sophos Gateway Unit
4.
Click Save to complete the DNAT definition.
The new rule appears on the NAT table. The rule is created but still not active.
Figure 6 First Steps: Inactive DNAT Rule
5.
Click the gray toggle switch to activate the rule.
The toggle switch turns green by that confirming that the rule is applied and active.
Figure 7 First Steps: Active DNAT Rule
The configuration of the local Sophos gateway unit is now completed: The security system is registered in Sophos UTM Manager and the communication between remote UTM units and the SUM server in the local network is allowed.
2.3 Configuring Remote Sophos Gateway
Unit
Access the WebAdmin interface of the external security systems (UTM 02-08 in our
and make the following settings:
1.
Preparing Connection to the SUM Server
2.
2.3.1 Preparing Connection to the SUM Server
To connect the remote security system to the SUM server, the SUM server must first be defined on the WebAdmin interface of the remote gateway unit (UTM 02-08 in our
1.
On the Definitions & Users > Network Definitions page, click New Network
Definition.
The Create New Network Definition dialog box opens.
SUM V4 Gateway Manager
11
2.3 Configuring Remote Sophos Gateway Unit
2 First Steps
2.
Make the following settings:
Name: Enter the name of the server (e.g., SUM Server).
Type: Set the network type (e.g., Host).
IPv4 address: Enter the IPv4 address of the SUM server (e.g. 65.227.28.232).
Comment (optional): Add a description or other information.
3.
Click Save.
The server will be added to the Network Definitions list.
2.3.2 Selecting the SUM Server
Now you need to select the defined SUM server. In the Management > Central Management menu of the remote gateway unit's WebAdmin interface (UTM 02-08 in our
), proceed as follows:
1.
On the Sophos UTM Manager tab, enable SUM.
Click the toggle switch.
The toggle switch turns amber and the SUM Settings area becomes editable.
2.
Specify the SUM host.
Select or add the SUM server UTM should connect to.
l
Authentication (optional): If the SUM server requires authentication, select this option and enter the same password (shared secret) as configured on the SUM server.
l
Use SUM server as Up2Date cache (optional): Up2Date packages can be fetched from a cache located on the SUM server. If you want to use this functionality for your gateway, select the option Use SUM server as Up2Date cache.
Please ensure that on your managing SUM server the Up2Date cache functionality is enabled accordingly. Note that usage of the Up2Date cache functionality is mutually exclusive with using a parent proxy configuration for Up2Dates.
3.
Define the rights of the SUM administrator.
On SUM, the administrator responsible for this UTM can only administer those areas of your UTM which are explicitly allowed to be administered here. The rights listed here correspond to the SUM Gateway Manager main menu and administrative options.
12
SUM V4 Gateway Manager
2 First Steps
2.3 Configuring Remote Sophos Gateway Unit
Administration: If selected, the administrator can use all features located in the Main-
tenance and Management menus. He can, for example, view the inventory, create and restore backups, and schedule actions like firmware updates.
Reporting: If selected, the administrator can use all features located in the Reporting menu. He can, for example, request reports from UTM.
Monitoring: If selected, UTM will be displayed on the Monitoring pages and the administrator can use all associated features.
Configuration: If selected, the administrator can use all features located in the Con-
figuration menu. He can, for example, deploy objects (networks, hosts, VPNs) to UTM.
4.
Click Apply.
Your settings will be saved.
UTM will now try to establish a connection to Sophos UTM Manager. Once the connection between both systems is established, the connection status will turn green. Then
UTM can be monitored and administered by the SUM server selected here. You will be able to see the current connection status and health in the SUM Health section. Reloading the page will update this data. Please use the Open Live Log button and read carefully the messages from the message board to be able to diagnose connection problems should they occur.
Note – The communication between the Sophos gateway unit and SUM takes place on port
4433
, whereas Sophos UTM Manager can be accessed through a browser via the HTTPS protocol on port 4444 for the WebAdmin and on port 4422 for the Gateway Manager interface.
You can always disable the connection to the SUM server by clicking Disable. This will also allow you to access a manual Cleanup Objects button, should a need arise to remove SUM-created objects on a particular device. This functionality is available starting with V7.4 of the gateway product line. Further information can be found in the Configuration >
section or the documentation for the Management > Central Management settings of the respective device.
The configuration of the first remote Sophos gateway unit is now finished. To complete the setup, configure all remaining Sophos gateway units alike.
SUM V4 Gateway Manager
13
3 Navigation
This chapter provides information on the usage of the Gateway Manager's interface, its icons, and control elements.
The following topics are included in this chapter: l
l
l
l
l
Page Actions and Control Panels
l
l
l
3.1 Menu
This section describes the graphical elements of the web-based browser interface of the Gateway Manager. The Gateway Manager is available by default at port 4422, for example https://192.168.2.200:4422
.
Note – The port can be changed using SUM WebAdmin interface on the Management >
Sophos UTM Manager > General tab.
3.1 Menu
3 Navigation
Figure 8 Navigation: Overview of Gateway Manager’s Interface
The Gateway Manager is dedicated for monitoring and management activities of different types of Sophos gateways. It allows users with appropriate privileges to display and monitor all security- and maintenance-relevant information of connected Sophos gateways. Moreover, it is possible to execute frequently used maintenance activities directly from SUM. For more advanced management or maintenance, Gateway Manager can directly redirect you to a gateway's
WebAdmin interface with appropriate user privileges. SUM itself cannot be managed via a gateway's WebAdmin.
The Gateway Manager interface consists of a menu and pages, which may have one or more tabs. When you select a menu item, such as Monitoring, it expands to reveal a submenu. When you select one of the submenu items, the associated page opens at its first tab.
Another Gateway Manager interface elements is the Device tree view, which helps you to select a set of devices with common attributes and actions, providing control panels on all monitoring pages.
The procedures in this help direct you to a page by specifying the menu item, the submenu item, and the tab, for example:
"To see overall status of the devices in the Listview, go to Monitoring > Dashboard > Listview."
16
SUM V4 Gateway Manager
3 Navigation
3.2 Device Tree
3.2 Device Tree
This section describes the tree views in the navigation panel. Device trees help you sort your gateway devices according to certain attributes such as location, model, or time zone. Once you have logged into Sophos UTM Manager, select a tree and folder to have your gateway devices displayed in the menus for
,
Each Device tree has several levels. Each level represents a particular device attribute, which for the most part is taken from the information in the Management >
menu. The following Device trees are available:
By Appliance Model
(not configurable, as the information is directly imported from the device) l
First level: device type (one of the following: hardware, software, virtual) l
Second level: hardware model if device type is Hardware (e.g., UTM 525) or software model if device type is Software or Virtual (UTM, ASG, AWG, or AMG).
By Company Name
l
First level: company name
By Country And City
l
First level: country l
Second level: city
By Custom Field
l
First level: custom field
By Device Name
l
First level: first letter of the device name
By Firmware Version
(not configurable, as the information is directly imported from the device) l
First level: major version number l
Second level: full version number
SUM V4 Gateway Manager
17
3.3 Lists
3 Navigation
By HA/Cluster Type
l
First level: cluster type (one of the following: hot-standby, off, zeroconf, cluster)
By Time Zone
l
First level: time zone
All devices are grouped in accordance with the information specified for the selected attribute
(s). The total number of devices contained in a particular folder is given in parentheses.
Devices that could not be classified according to the selected attribute(s) are combined in a folder labeled Undefined. For example, a device may have no Country attribute specified, but the City attribute set to Berlin. This device would then appear in the By Country And City tree in the folder Undefined > Berlin.
3.3 Lists
Many pages in Gateway Manager consist of lists. The buttons on the left of each list item enable you to edit, delete, or clone the item (for more information see section Buttons and Icons). To add an item to the list, click the New … button, where "…" is a placeholder for the object being created (e.g., service definition). This opens a dialog box where you can define the properties of the new object.
Figure 9 Gateway Manager: Example of a List
With the first drop-down list on the top you can filter all items according to their type or group.
The second field on the top lets you search for items specifically. Enter a search string and click
Find.
Lists with more than ten items are split into several chunks, which can be browsed with Forward
(>>) and Backward (<<) buttons. With the Display drop-down list, you can temporarily change the number of items per page.
18
SUM V4 Gateway Manager
3 Navigation
3.4 Searching in Lists
The header of a list provides some functionality. Normally, clicking a header field sorts the list for that object field of that name, e.g. clicking the field Name sorts the list by the objects' names. The
Action field in the header contains some batch options you can carry out on previously selected list objects. To select objects, select their checkbox. Note that the selection stays valid across multiple pages, that is, while browsing between pages of a list already selected objects stay selected.
Tip – Some lists offer one or more icons on the right side of the list entries. Clicking on a blue icon will show you detailed information about the object. The icons are explained in the respective sections of this documentation according to their appearance in Gateway Manager.
3.4 Searching in Lists
A filter field helps you to quickly reduce the number of items displayed in a list. This makes it much easier to find the object(s) you were looking for.
Important Facts
l
A search in a list typically scans several fields for the search expression. A search in
Users & Groups for example considers the username, the real name, the comment, and the first email address. Generally speaking, the search considers all texts which you can see in the list, excluding details displayed via the Info icon.
l
The list search is case-insensitive. That means it makes no difference whether you enter upper- or lower-case letters. The search result will contain matches both with uppercase and lower-case letters. Searching explicitly for upper-case or lower-case letters is not possible.
l
The list search is based on Perl regular expression syntax (although case-insensitive).
Typical search expressions known from e.g. text editors like * and ? as simple wildcard characters or the AND and OR operators do not work in list search.
Examples
The following list is a small selection of useful search strings:
SUM V4 Gateway Manager
19
3.5 Page Actions and Control Panels
3 Navigation
Simple string: Matches all words that contain the given string. For example, "inter" matches
"Internet", "interface", and "printer".
Beginning of a word: Mark the search expression with a \b at the beginning. For example,
\binter matches "Internet" and "interface" but not "printer".
End of a word: Mark the search expression with a \b at the end. For example, http\b matches "http" but not "https".
Beginning of an entry: Mark the search expression with a ^ at the beginning. For example,
^inter matches "Internet Uplink" but not "Uplink Interfaces".
IP addresses: Searching for IP addresses, you need to escape dots with a backslash. For example, 192\.168 matches "192.168".
To search more generally for IP addresses use \d which matches any digit. \d+ matches multiple digits in a row. For example, \d+\.\d+\.\d+\.\d+ matches any IPv4 address.
Note – It makes sense to rather use an easy, fail-safe search expression which will lead to more matches than to rack your brains for a supposedly more perfect one which can easily lead to unexpected results and wrong conclusions.
You can find a detailed description of regular expressions and their usage in Sophos UTM Manager in the Sophos Knowledgebase .
3.5 Page Actions and Control Panels
Each device monitoring page and some maintenance and management pages provide you with an actions and control panel located at the top part of the tab. This panel allows you to select and execute different functions for each device. To activate the buttons the respective devices must be selected first. In the cardview, this is accomplished by clicking on a single device panel.
The selected panel is highlighted by an orange frame. In the listview, you select a device by selecting the respective checkbox. Note that double-clicking a panel will open the Details view for this device directly. Once you have selected a device from the Dashboard, the following controls become active (from left to right): l
l
l
20
SUM V4 Gateway Manager
3 Navigation
3.5 Page Actions and Control Panels l
l
l
Note – You can select more than one device. On the Cardview tab, keep the Ctrl key pressed while you click or select devices. On the Listview tab and on similar pages, select several checkboxes or use the checkbox to the left of the table header to select all entries.
However, if you select more than one device, the control buttons Details and WebAdmin will be deactivated.
3.5.1 Device Actions
The device actions drop-down list is located on the upper left of all Monitoring pages (except
Dashboard > Worldmap), the Maintenance > Inventory page, and some other pages. Actions from this list can be applied to one or more devices simultaneously. You can choose between the following actions: l
Prefetch Up2Date(s): Triggers the download of system Up2Date packages onto the selected device.
l
Install Firmware: Triggers the installation of prefetched system Up2Date packages.
l
Install Pattern: Triggers the installation of pattern Up2Date packages.
l
Shutdown: Shuts down the selected device.
l
Reboot: Reboots the selected device. Depending on your hardware and configuration, a complete restart can take up to five minutes.
Note – Keep in mind that in the event of possible problems during the restart the device can no longer be remotely administered; a restart is only possible on site. The status of the executed option will be added to the Maintenance > Scheduled Operations page.
3.5.2 Details
The Details button opens a page with detailed information of the selected device or object. The information provided depends on the main menu entry you have selected. See the respective chapters for more information on the Details view:
SUM V4 Gateway Manager
21
3.5 Page Actions and Control Panels
3 Navigation
l
Monitoring >
l
Maintenance >
l
Maintenance >
l
Configuration >
l
Configuration > VPN >
l
Reporting > On Demand >
3.5.3 WebAdmin
The WebAdmin button opens the user interface (WebAdmin) of the selected device by automatically granting access without the need to authenticate again. However, the new session is neither tunneled nor proxied by SUM. The IP address or DNS name used for the connection can be specified via the SSO mode of the device.
To distinguish a WebAdmin session opened by the Gateway Manager from a WebAdmin session where the user directly logged in, the username displayed in the WebAdmin session log entries will be provided with the appendix (SUM).
Note – Pop-up blockers may prevent opening WebAdmin in a new window.
3.5.4 Display
Via the Display drop-down list you can define the maximum number of devices displayed on one page. If the number of monitored devices exceeds the specified value, you can browse through the pages via the navigation arrows.
3.5.5 Sort
On the Cardview tab, you can sort devices via the sort drop-down list. The following sort options are available: l
Name l
Level l
Connection l
Threat
22
SUM V4 Gateway Manager
3 Navigation
3.6 Organizational Unit l
License l
Version l
Resource l
Service l
Availability
On the Listview tab and on similar pages, you can sort the devices for a field by clicking the respective column header. Additionally you can use an automatic sorting capability, which allows you to sort page-related data, considering recently received notifications. Specify the time interval to be used for automatic sorting.
3.5.6 Navigation Arrows
Another utility available on the actions and control panel are the page navigation arrows, which help you to navigate the page content when a large amount of devices is monitored by Gateway
Manager. The number of devices displayed per page can be defined via the Display drop-down list.
3.6 Organizational Unit
The drop-down menu Organizational Unit (OU) refers to a way you may organize the devices you manage with your Sophos UTM Manager (for extensive information on this topic see chapter Management >
). When opening the drop-down menu you see all
available OUs or, if you have restricted rights, all OUs you are allowed to see. There are two default OU items that are available for everyone: l
All: Selecting this OU displays all devices, respectively all items, that are related to any
OU. How many devices you see depends on your user privileges (see chapter Man-
agement >
for more information on user privileges).
l
Global: Selecting this OU displays all devices, respectively all items, that have been defined to be global (see chapter Management >
for more information on global objects). Note that there is no need to have any global objects defined, so there may be no device or other item visible.
If there are other OUs defined (and visible to you) you can select one of them and you will be successively displayed all devices or other items that are related to the selected OU. Other items can be e.g. network definitions.
SUM V4 Gateway Manager
23
3.7 Filter Bar
3 Navigation
Note – When nothing is displayed to you in a certain menu or submenu, e.g. Management >
Registration and you are sure, that there must be at least one device, and your user rights are correct to see those devices, make sure that you have selected the right organizational unit. If in doubt, select All from the OU drop-down menu.
3.7 Filter Bar
The Filter bar allows you to filter devices based on various criteria. It is really helpful when there are many managed devices. There are different search criteria available depending on the page you have currently opened. When you select more than one criteria then the logical AND operator is used to determine which devices are to be displayed.
In all Listviews you can select devices by their name, following a regex criteria, e.g., ^gw for finding all devices with names beginning with gw.
The page Monitoring > Versions has some special Filter bar features which apply to the columns Version (firmware version), Active (global pattern version), and both Failures columns.
The same yields true for Maintenance > Inventory for the columns CPU and Network. You could write a selection criteria following these rules:
>9.000000
Select items, for which the number in the field is bigger than the given number.
=9.000000 Select items, for which number in the field equals the given number.
!9.000000
Select items, for which number in the field is different than the given number.
<9.000000 Select items, for which number in the field is smaller than the given number.
9.*0 or 9
Select items, for which data in the field matches the regular expression. The regex is not case-sensitive.
3.8 Buttons and Icons
This chapter describes the buttons and icons you will meet throughout Gateway Manager. It is most advisable to get to know the meaning of each icon to be able to identify and react to malfunction.
24
SUM V4 Gateway Manager
3 Navigation
3.8 Buttons and Icons
Icons Mainly Used on Monitoring Pages
Icons Meaning
Monitored value trend rapidly decreased
Monitored value trend decreased
Monitored value trend is flat or minor changes
Monitored value trend increased
Monitored value trend rapidly increased
Monitored item is not enabled or not available on the device
Monitored item functions normally
Monitored item does not function normally
Optimum operating status (risk level 0)
Minor irregularities (risk level 1)
Medium risk (risk level 2)
Increased risk (risk level 3)
Alert (risk level 4)
No connection to monitored device
License expiry is far away
License expires the next days
Buttons and Icons Mainly Used on Configuration Pages
Buttons Meaning
Shows a dialog box with detailed information on the object.
Opens a dialog box to edit properties of the object.
Deletes the object. If an object is still in use somewhere, there will be a warning. Not all objects can be deleted if they are in use.
SUM V4 Gateway Manager
25
3.8 Buttons and Icons
3 Navigation
Buttons Meaning
Opens a dialog box for creating an object with identical settings/properties. Helps you to create similar objects without having to type all identical settings over and over again.
Functional
Icons
Meaning
Info: Shows all configurations where the object is in use.
Details: Links to another Gateway Manager page with more information about the topic.
Toggle switch: Enables or disables a function. Green when enabled, gray when disabled, and amber when configuration is required before enabling.
Folder: Has two different functions: (1) Opens an object list (see section below) on the left side where you can choose appropriate objects from. (2)
Opens a dialog window to upload a file.
Plus: Opens a dialog window to add a new object of the required type.
Action: Opens a drop-down menu with actions. The actions depend on the location of the icon: (1) Icon in list header: the actions, e.g., Enable, Disable,
Delete, apply to the selected list objects. (2) Icon in text box: with the actions
Import and Export you can import or export text, and with Empty you delete the entire content. There is also a filter field which helps you to drill down a list to relevant elements. Note that the filter is case-sensitive.
Empty: Removes an object from the current configuration when located in front of the object.
Removes all objects from a box when located in the Actions menu.
Objects are however never deleted.
Import: Opens a dialog window to import text with more than one item or line.
Enhances adding multiple items without having to type them individually, e.g.
a large blacklist to the URL blacklist. Copy the text from anywhere and enter it using CTRL+V.
Export: Opens a dialog window to export all existing items. You can select a delimiter to separate the items, which can either be new line, colon, or comma. To export the items as text, mark the whole text in the Exported Text field and press CTRL+C to copy it. You can then paste it into all common applications using CTRL+V, for example a text editor.
26
SUM V4 Gateway Manager
3 Navigation
3.8 Buttons and Icons
Functional
Icons
Meaning
Sort: Using these two arrows, you can sort list elements by moving an element down or up, respectively.
Forward/Backward: Depending on the location you can navigate through the pages of a long list, or move back and forth along the history of changes and settings.
PDF: Saves the current view of data in a PDF file and then opens a dialog window to download the created file.
CSV: Saves the current view of data in a CSV (comma-separated values) file and then opens a dialog window to download the created file.
There are a lot more icons throughout Gateway Manager. Those are explained in the respective sections of this manual according to their appearance in Gateway Manager.
SUM V4 Gateway Manager
27
4 Monitoring
The submenus and pages of device monitoring allow you to monitor and administer gateway devices operated by Sophos UTM Manager. They provide a general overview of the state of each registered device including its version, current load, license expiration, and critical security events.
The information is accessible through various view options for all monitored devices, most notably in the form of a Dashboard. By using this graphical display you are able to react immediately to problems and critical events.
The following topics are included in this chapter: l
l
l
l
l
l
l
l
4.1 Device Monitoring Details
Via the Details button in the control panel you have direct access to further information on a selected device. Furthermore, depending on the submenu currently open, you are redirected to the section correspondent to this submenu. For example if you selected a device from the
Monitoring > Resources menu, clicking Details will direct you straight to the Resource Inform-
ation section of the Details view.
The Device Monitoring Details page is subdivided into the following sections: l
Basic Information: This section contains the basic settings of the device, e.g., the hostname and product type.
4.2 Dashboard
4 Monitoring
l
Threat Information: This section contains an overview of the security threats and of the administrative events which occurred over the last 30 days.
l
License Information: This section contains the license information for the device, e.g., number of protected users and subscription expiration dates.
l
Version Information: This section displays the current Firmware and Pattern version of the device. Depending on the device, patterns may encompass Virus Protection, Intrusion Prevention, and Spyware Protection, and documentation aspects like online help and enduser manuals.
l
Resource Information: This section describes the utilization of the system hardware, e.g., CPU usage, and memory consumption. If available, RED interfaces and wireless
LAN interfaces will be displayed here, too. A checkmark in the Link cell of a RED interface means that the tunnel is established. Wireless interfaces configured as separate zones will be displayed in their own section whereas wireless interfaces which are bridged to a
VLAN will be displayed in the Network Usage section.
l
Service Information: This section displays detailed information about device services, e.g., if critical services are up and running and augmented with their respective resource usage.
l
Availability Information: This section displays information related to availability enhancing measures, e.g., HA/Cluster, RAID, and UPS.
Tip – With the Back button you can return to the previous page. For more information on how to use the controls please see chapter Navigation >
Page Actions and Control Panels
4.2 Dashboard
The Dashboard graphically displays a snapshot of the current operating status of each registered gateway device. This includes information about the following parameters: l
: Currently existing security threats and administrative events, e.g., firewall viol-
ations or failed logins.
l
: Important licensing information such as expiration dates for subscriptions and
number of concurrent users as well as connections.
l
: Current information on firmware and pattern versions which are installed
and/or available for this particular device.
l
: System resource utilization, e.g., CPU usage, memory consumption.
30
SUM V4 Gateway Manager
4 Monitoring
4.2 Dashboard l
: Status of enabled services, depending on the type of gateway product.
l
: Status for availability enhancing measures, e.g., HA/Cluster, UPS, RAID.
The Dashboard is made up of three different tabs, each providing a certain view over the registered gateway devices: l
l
l
4.2.1 Cardview
The Dashboard's Cardview tab is made up of individual status panels, each representing the health of one gateway device. At the top of the page there is located a Filter bar which allows you to filter the displayed devices for certain thresholds.
Note the filter called Name: Here you can enter (the part of) a device's name which will subsequently restrict the displayed devices accordingly.
The following panel shows an online UTM gateway with minor irregularities in threats and resources.
Figure 10 Dashboard: Example Dashboard Card
To manage UTMs it is necessary to have the correct SUM-version. SUM 4.2 supports configuring UTM 9.2 only. Other UTM versions will appear in SUM as well and can be monitored.
Devices which are not fully supported have a warning symbol next to the device name.
Each Dashboard panel consists of several icons and progress bars representing the risk levels for
,
,
Availability , and Services . Click a device to select it
for further actions. For example, the buttons Details and WebAdmin become active and you can select actions from the actions drop-down list (With selected):
SUM V4 Gateway Manager
31
4.2 Dashboard
4 Monitoring
l
Reboot l
Shutdown l
Prefetch Update(s) l
Install Firmware l
Install Pattern
You can access these actions also by right-clicking a device. This will open a context menu from which you can select the desired action.
Also, you can select more than one device by holding the Ctrl key down while clicking the desired devices.
Special security status icons, which are colored green, yellow, or red, indicate the overall security state of the device being monitored. The overall security status is based on the progress bars for
,
,
, and
Tip – Double-clicking a device opens the Details page for a device.
Icons Indicating the Overall Status of a Device
The device operates under optimum conditions or there are some minor irregularities which, however, do not represent a serious security risk.
The device does not operate under optimum conditions and is in some type of problem state. System resources might come close to a critical value or there are indicators of security-threatening events.
The device is threatened. One or more security-relevant parameters have reached critical values.
Icons Monitoring Different Functions
Each security-relevant parameter has its own critical values. There are five levels, each one represented by an individual icon:
Optimum operating status (risk level 0)
Minor irregularities (risk level 1)
Medium risk (risk level 2)
Increased risk (risk level 3)
32
SUM V4 Gateway Manager
4 Monitoring
4.2 Dashboard
Alert (risk level 4)
Icons Indicating Connection Status
Connection status icons indicate whether a device is online or offline.
Device is connected to Sophos UTM Manager (online)
Device is not connected to Sophos UTM Manager (offline)
Tip – Hover over the icon to see since when the device is connected respectively, for offline devices, when the last contact was made.
Icons Indicating Up2Date Installation Status
Up2Date installation status icons can bear the following meanings:
Up2Date installation successful
(animated) Up2Date in progress
Up2Date installation failed
Tip – Hover over the icon to see the progress of a currently performed update, its type, and its textual information.
Icons Indicating High-Availability Status
High-Availability status icons can bear the following meanings:
Stand-alone system
High-availability (all nodes active)
High-availability cluster (all nodes active)
At least one node is not active
Take-overtake-over in progress
SUM V4 Gateway Manager
33
4.2 Dashboard
4 Monitoring
Icons Indicating Device Type
On Cardview, there are additional overlay icons that indicate the device type:
ASG or UTM Subscription
AWG or Web Subscription
AMG or Mail Subscription
4.2.2 Listview
Basically, the Listview tab contains the same information as the Cardview tab, but shows all devices in a simple grid. In addition, the Listview contains the column Sync in the Filter bar which provides information on the high-availability status of the device at a glance.
Note the filter called Device Name: Here you can enter (the part of) a device's name which will subsequently restrict the displayed devices accordingly.
In Listview only, you can use an automatic sorting capability, which allows you to sort pagerelated data, considering recently received notifications. Specify the time interval to be used for automatic sorting.
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Monitoring Details page for this device.
4.2.3 Worldmap
The Worldmap gives you a quick overview of all monitored devices. In addition to the Cardview or Listview, the Worldmap provides geographic information and helps you locate your devices worldwide by means of satellite imagery. The real-world geographic location of the device is especially determined by tracking its IP address, a technique also known as geo-location
(GeoIP). However, as geo-location data may be inaccurate, you can change the position of the device on the map by changing its longitude and latitude in the Management >
menu.
Note – Devices with exactly the same values both for longitude and latitude share the same position on the map, so that it appears as though these devices were merged into one. The
34
SUM V4 Gateway Manager
4 Monitoring
4.2 Dashboard icon of such an accumulation of devices is marked with a green Plus icon and clicking on it will open a small dialog window where you can see all devices of this location. The status bar of an accumulation icon always reflects the status of the underlying device with the worst status.
Overall Status
Each device is displayed by a single icon, having an overall status bar color according to the state of the device:
Green: The device operates under optimum conditions or there are some minor irregularities which, however, do not represent a serious security risk.
Yellow: The device does not operate under optimum conditions and is in some type of problem state. System resources might come close to a critical value or there are indications of security-threatening events.
Red: The device is threatened. One or more security-relevant parameters have reached critical values.
By default, all devices are shown—which is indicated by a white arrow near the green bar. If you click the yellow bar, all devices with yellow and red security states are shown. Clicking the red bar will show all devices with red security states only.
Control Elements
To move a section of the map depending on the directions of the mouse, click and hold down the left mouse button while moving the pointer. To zoom in, you can either double-click into the area you want to enlarge or by means of the navigation controls.
Up arrow: Move viewport upwards.
Down arrow: Move viewport downwards.
Left arrow: Move viewport to the left side.
Right arrow: Move viewport to the right side.
Minus: Zoom out.
Plus: Zoom in.
World: Fit zoom to whole world.
Fullscreen On: Activates fullscreen mode.
SUM V4 Gateway Manager
35
4.3 Threats
4 Monitoring
Fullscreen Off: Deactivates fullscreen mode.
Name: Enter a (part of a) device's name to restrict the displayed devices.
Plus: Expand the overview dialog to move the region.
Minus: Close the overview dialog.
4.3 Threats
This screen gives you detailed information about the current threats for each registered device.
Critical values are color-highlighted. Move the pointer over the highlighted value for a short explanation. In addition to the device name and level of the security state, information about the following types of threats is available:
Violations
The number of firewall violations that has been detected.
Intrusions
The number of detected Intrusion Prevention events. An intrusion attack is usually recognized by means of a signature-based intrusion detection rule set.
Portscans
The number of detected portscans. Portscans are usually used to discover which network services are available on a certain system.
Logins
The number of login attempts, including logins via WebAdmin as well as remote and local logins.
Viruses
The number of SMTP, POP3, HTTP, and FTP viruses detected by the gateway's built-in antivirus engines.
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Monitoring Details page for this device.
36
SUM V4 Gateway Manager
4 Monitoring
4.4 Licenses
4.4 Licenses
This screen gives you detailed information about the licenses for each registered device, including the current license utilization level as well as the remaining time until subscription based services of the license will expire. Critical values are color-highlighted. Move the pointer over the highlighted value for a short explanation. In addition to the device name and level of the security state, the following information is available:
Connection Limit
The number of concurrent connections in percent relative to the allowed maximum (according to the license). Not available if the number of maximum connections is unlimited.
User Limit
The number of concurrent users (IP addresses) protected by this device in percent relative to the allowed maximum (according to the license). Not available if the number of maximum users is unlimited.
Next Expiry
Date of the license subscription which will expire next.
License Options
The symbols represent subscription options on the respective device. When an option is enabled, the respective symbol is active. Move the pointer over the symbols for their meaning: IPS (Intrusion Prevention), HA (High Availability/Hot-standby), SMP (Symmetric
Multiprocessing), Cluster (High Availability/Clustering).
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Monitoring Details page for this device.
4.5 Versions
This screen provides copious information on the security level of each registered device concerning the availability of firmware and pattern updates (e.g., Antivirus, IPS, and AntiSpam).
Depending on the gateway product type, not all pattern types may be available for your device.
SUM V4 Gateway Manager
37
4.5 Versions
4 Monitoring
Critical values are color-highlighted. Move the pointer over the highlighted value for a short explanation. In addition to the device name and level of the security state, the following information is available:
Version
The version number of the Sophos gateway product that is currently installed on the device.
Prefetch
Shows if the option Enable Automatic Firmware Download for firmware Up2Dates is enabled or disabled on the managed device. This function automatically loads new firmware Up2Date packages to the device. The configuration of the firmware Up2Date module is done in WebAdmin under Management > Up2Date > Configuration.
Failures
The number of failed installation installing Up2Date attempts for firmware Up2Date packages.
Active
Current pattern version number.
Install
Shows if the option Enable Automatic Pattern Installation for pattern Up2Dates is enabled or disabled on the managed device. This function automatically downloads and installs new patterns for antivirus and IPS as well as new versions for online help and manuals. The configuration of the pattern Up2Date module is done in WebAdmin under Management > Up2Date > Con-
figuration.
Failures
The number of failed installation attempts for pattern Up2Date packages.
Progress
This depicts the firmware/pattern Up2Date download/installation progress, should any such operation be taking place.
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Monitoring Details page for this device.
38
SUM V4 Gateway Manager
4 Monitoring
4.6 Resources
4.6 Resources
This screen gives you detailed information about the system resources for each registered device. Values are color-highlighted in accordance with current alert condition. Move the pointer over the values for a short explanation. In addition to the device name and level of the security state, the following information is available:
Load
The average of the system load during the last five minutes and a trend indicating the expected change of the load within the next minute.
CPU
The CPU usage in percent. If you have more than one CPU, it is the average of all CPUs. A tooltip provides additional information on each CPU.
Memory
The amount of used memory in percent and the absolute number of free and total memory available to the system.
Swap space
The amount of used swap space in percent the absolute number of free and total swap space available to the system.
HDD
The capacity of the hard disk drive. A tool-tip provides information on all relevant system partitions and their respective usage.
NET
Status of known device network interface cards. A tool-tip provides information on overall interface and link status as well as the current bandwidth usage.
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Monitoring Details page for this device.
SUM V4 Gateway Manager
39
4.7 Services
4 Monitoring
4.7 Services
This screen provides you with abstract information on service groups and data on the underlying actual services for each registered device. Icons on the columns show potential problems within one of the service groups or whether a service group is enabled or disabled. Move the pointer over the icon for a short explanation. In addition to the device name and level of the security status, information about the following services is available:
Network Services
NTP, DNS, DHCP servers.
Network Protection
SOCKS proxy, intrusion prevention.
Web Protection
FTP proxy, HTTP proxy.
Email Protection
SMTP proxy, POP3 proxy.
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Monitoring Details page for this device.
4.8 Availability
This screen gives you detailed information about the availability enhancing hardware and system configurations for each registered device. Typical measurements are HA systems, RAID systems, and UPS systems. Values are color-highlighted in accordance with current alert condition. Move the pointer over the values for a short explanation. In addition to the device name and level of the security status, the following information is available:
Type
The high-availability system type, e.g., stand-alone, hot-standby, cluster or zero-conf.
40
SUM V4 Gateway Manager
4 Monitoring
4.8 Availability
Node
The number of active nodes compared to the total number of nodes.
Version
Shows if the firmware version between HA/Cluster nodes is synchronized.
Takeover
The amount of time elapsed (in seconds) since the last take-over has occurred.
UPS
If the device is equipped with an Uninterruptible Power Supply (UPS) unit, its battery charge in percent is shown.
RAID
If the device is equipped with a RAID system, the synchronization state in percent or a potentially degraded hard disk in the system is shown here.
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Monitoring Details page for this device.
SUM V4 Gateway Manager
41
5 Maintenance
Assuming you have sufficient access privileges, you can perform basic maintenance operations for connected devices using this menu. Note that you must either be admin or a user who has
Maintenance privileges.
The following topics are included in this chapter: l
l
l
5.1 Inventory
Sophos UTM Manager comes with an inventory feature showing relevant hardware information of each device, including CPUs, hard disk drives, CD-ROMs, NICs, and so forth. To access inventory, select the tree and node for which you want to have inventory data displayed.
Type
The type of the device.
CPU
The number of CPUs. Processors capable of simultaneous multi-threading (also known as hyper-threading) are counted as two processors.
Memory
The amount of RAM.
Hard Disk
The amount of space available on hard disks.
CD-ROM
The availability of CD-ROM drive.
Network
The number of network interfaces.
5.2 Scheduled Operations
5 Maintenance
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Inventory Details page for this device.
5.1.1 Device Inventory Details
Via the Details button in the control panel you have direct access to further information on a selected device.
The Device Inventory Details page is subdivided into the following sections: l
Basic Information: This section contains the basic settings of the device, e.g., the hostname and product type.
l
CPUs: This section contains information on the CPU(s) of the device, such as model, speed, and cache size.
l
Memory: This section contains information on the RAM and swap memory of the device.
l
Network Interfaces: This section contains information on installed network interfaces of the device.
l
Hard Disks: This section contains information on installed hard disks of the device, such as vendor and size.
l
CD-ROMs: This section contains information on installed CD- and DVD-ROM drives of the device.
l
System: This section contains information on the device's system such as BIOS and motherboard information and the operating system.
Tip – With the Back button you can return to the previous page. For more information on how to use the controls please see chapter Navigation >
Page Actions and Control Panels
5.2 Scheduled Operations
The Scheduled Maintenance feature of the Gateway Manager allows you to initiate various maintenance events for managed devices to occur on a specific date and time. You can schedule events to be executed once, or on certain days of the week. To add a new scheduled operation, please proceed as follows:
44
SUM V4 Gateway Manager
5 Maintenance
5.2 Scheduled Operations
1.
Open the Maintenance > Scheduled Operations page.
2.
Click the New Action button.
The Create New Action dialog box opens.
3.
Select the operation you want to schedule.
The following operations can be scheduled: l
Reboot: Select to initiate a restart of the selected device.
l
Shutdown: Select to shutdown the selected device.
l
Prefetch Up2Date(s): Select to initiate the download of all available Up2Date packages onto the selected device.
l
Install Firmware: Select to initiate the installation of prefetched firmware
Up2Date packages.
l
Install Pattern: Select to initiate the installation of downloaded pattern Up2Date packages.
4.
Choose how often the event should be executed.
Use the drop-down list and select once, if you want to schedule operation once or daily, if you want to schedule an event on particular weekdays.
5.
Select the date and time.
Use the drop-down lists or the date selector widget to specify the date on which the operation should occur.
6.
Select the device(s).
Select the device(s) for which the scheduled operation should be applied.
7.
Click Save.
Your settings will be saved.
The newly created scheduled operation will appear as a new entry in the list of scheduled actions. Each entry has a Delete and Status button which you can use to remove the operation or view detailed status information. The entry provides also the following information: l
The name of the scheduled maintenance event l
The name of the administrator who scheduled the operation.
l
Date and time on which the operation is scheduled.
l
The time when the operation will be executed or was executed.
l
If the operation is still to be executed then the number of scheduled devices is displayed.
SUM V4 Gateway Manager
45
5.3 Backup/Restore
5 Maintenance
l
If the operation was already executed the number of devices on which the operation failed and the number of devices for which the operation was successful are displayed.
Note – The time of the scheduled operations is displayed according to your system time. If the time zone of SUM differs from the time zone of your system, the time is automatically adapted
(e.g. the action is scheduled for 1 pm UTC and your local system time is CEST (UTC+2) then
3 pm is displayed).
5.3 Backup/Restore
The Backup/Restore menu of SUM provides functionalities to create backups from managed devices, either individually or as a batch, and also automatically at defined periods. Backups are useful to possess a known good configuration which can be installed on a new or misconfigured system. Backups can be restored directly from SUM. Additionally, there is detailed information on the backup creation and restoration history of each managed device.
Note – Backup management via SUM is only supported for devices of version 8.200 or later.
Be sure to make a backup after every system change. This will ensure that the most current settings are always available. In addition, keep your backups in a safe place, as it also contains security-relevant data such as certificates and cryptographic keys. After generating a backup, you should always check it for readability. It is also a good idea to use an external program to generate MD5 checksums, for this will allow you to check the integrity of the backup later on.
5.3.1 Backup Overview
On the Backup Overview page you see a table of all managed devices and their backup status. It reflects those backups which have been created both via SUM and locally on the device, either automatically or manually. If no backup has been created or all backups have been deleted, the rows display no information.
Note – Backup management via SUM is only supported for devices of version 8.200 or later.
Devices of previous versions are not displayed.
Backups
The number of available backups.
46
SUM V4 Gateway Manager
5 Maintenance
5.3 Backup/Restore
Comment
Backups can contain comments. The column displays the comment of the most recent backup and is empty if no comment has been given.
Date
The date of the last backup creation.
Version
The version number of the most recent backup.
Size
The size of the most recent backup.
Creator
The creator of the most recent backup.
You can sort all data by clicking the table column headers. Double-clicking into a row of the device table opens the Backup Details page for this device.
5.3.2 Backup Details
The Backup Details page displays further information on single devices. Here, you cannot only see the last backup but all backups available. From here you can perform the following actions with backups:
Delete: You can delete one or multiple backups at the same time. For that, select at least one backup and then press the Delete button.
Restore: You can restore a backup to the present device. If you want to make some adjustments to the backup before restoration or to restore it on a different device, use the Rollout function instead.
Download: You can download a backup to save the settings of a device to a file on a local disk.
Before downloading or sending it, you have the option to encrypt the backup. Encryption is realized with Blowfish cipher in CBC mode. Provide a password (second time for verification). You will be asked for this password when importing the backup. The file extension for encrypted backups is ebf, for unencrypted backups abf).
SUM V4 Gateway Manager
47
5.3 Backup/Restore
5 Maintenance
Note – A backup does include administrator passwords, the high availability passphrase if configured, as well as all RSA keys and X.509 certificates. Since this information is confidential, it is good practice to enable encryption.
Rollout: You can use a backup which has a known good configuration as a sort of template for other devices. SUM enables you to centrally roll out such a backup to multiple devices at the same time. Do the following:
1.
Click the Rollout button of a backup.
The Backup Rollout wizard opens.
Follow the steps of the wizard to deploy the backup.
2.
Select gateways and click Next.
Select one or multiple gateways that should receive and install the backup. The Devices object list only displays those devices that are compatible with the current backup.
Note – Backup rollout is only supported by devices with version 8.201 or later.
3.
Specify gateway parameters.
The name of the (first) selected gateway is displayed in the page header. Make the following settings for the gateway:
Hostname, Organization, City, Country, Email Address: These fields are optional.
If you do not fill in any information, the device will have the settings from the backup.
Password: You need to set an administrator password.
Network Parameters: You can decide whether to use the old network settings of the backup or to specify different network settings. If you select Set new parameters from the drop-down list, you need to enter an IP address, network mask and default gateway.
Reset: Use this button to easily clear all of the fields if you changed your mind or made a mistake.
4.
Click Next.
48
SUM V4 Gateway Manager
5 Maintenance
5.3 Backup/Restore
Note – If you selected more than one gateway, the page with the parameters for the next gateway will be displayed. Enter the parameters accordingly for each gateway until the summary page is displayed.
You see a summary of the settings you made.
5.
Click Next to confirm your settings.
The backup rollout will be performed.
6.
Click Finish to return to the Backup Overview page.
Tip – With the Back button you can return to the previous page. For more information on how to use the controls please see chapter Navigation >
Page Actions and Control Panels
5.3.3 Create Backups
On the Create Backups page you can create backups of one or more devices. For that, click the
Folder icon, select the device(s), enter optionally a descriptive comment and click Create
Backup. The created backups will be displayed on the Backup Overview page.
If a device is currently offline while you try to create a backup of it, the backup will not be created.
You will receive a notification for which devices backups could be created and for which not.
Note – There is an Info icon at the right bottom of the page as soon as a backup creation is finished. Clicking this icon opens an information bar which provides additional information on the creation process and result. You can close this bar by clicking it again. However, the information will be retained and can be accessed anytime by clicking again below the main WebAdmin area.
5.3.4 Automatic Backups
On the Automatic Backups page you can enable that backups are created on an automatic basis for all managed devices. Do the following:
1.
Enable automatic backups.
Click the toggle switch.
The Options area becomes editable.
SUM V4 Gateway Manager
49
5.3 Backup/Restore
5 Maintenance
2.
Select a backup interval.
Select the interval at which the backup should be created. This can be either monthly, weekly, or daily.
3.
Select a backup number to keep.
Select the number of automatically created backups to keep. The default is 5. When the threshold is met and the next backup is about to be created, the oldest backup is going to be deleted. Manually created backups, however, will never be deleted.
You cannot keep less than two automatic backups because it is useful to have backups of at least two different points in time.
4.
Click Apply.
To disable the automatic backup function again, click the green toggle switch.
50
SUM V4 Gateway Manager
6 Management
Depending on the access privileges of the user being logged in, all gateways connected to
Sophos UTM Manager can be managed within the submenus and pages of device management. This includes editing device specific information (device name, location, time zone, etc.) and managing access control settings. Additionally, you can define organizational units and their notification settings. On the Event Log tab event data can be displayed and deleted. The
MSP licensing feature lets you easily deploy and manage licenses and the subscriptions of connected UTMs.
The following topics are included in this chapter: l
l
l
l
l
l
6.1 Registration
This screen lists all devices that are connected to the Sophos UTM Manager depending on the access privileges of the user logged in.
Note – With the Allow and Deny buttons on top of the list you can change the view: If the Allow button is pressed, only allowed devices are displayed. If the Deny button is pressed, only blacklisted devices are displayed.
The following information are available:
Name
The name of the device.
Status
Connection status. The following two states are possible:
6.1 Registration
6 Management
l
Offline: There is no connection to Sophos UTM Manager.
l
Online: The connection to Sophos UTM Manager is established and active.
Org. Unit
The organizational unit the device is assigned to.
Public IP
The IP address by which the gateway device is identified on the Internet.
Agent IP
The IP address of the device (may differ from the public IP address).
FQHN
Fully Qualified Hostname of the device.
6.1.1 Controls
Assuming you have sufficient access privileges, the following controls become active for the devices on the Management > Registration tab:
Edit
Change basic information of the selected gateway device, such as device name, FQHN, time zone, geographic location (see Editing Device Information).
Delete
Permanently delete the device from Sophos UTM Manager and erase all data known or associated. The device will reconnect after a short time if the connection to SUM is not disabled within the Management > Central Management menu on the remote device. Please note, that it is not possible to delete a device from SUM if it is used in one or more VPN configuration settings. It is required to remove it from the dependent configurations first.
Deny
Prevent device from performing a login to Sophos UTM Manager. Use this functionality if you cannot block the device via the Allowed Networks settings in the SUM WebAdmin or you do not want to adjust the shared secret for your other devices.
52
SUM V4 Gateway Manager
6 Management
6.1 Registration
Please note, the affected device will be removed from the current view and relocated to the blacklist view. As with deletion of devices, blacklisting is not possible for devices which are still used in one or more VPN configurations.
To move a device back from the blacklist view to the regular registration view, first toggle the
Deny switch and then press the Allow button for the device that should be reinstated.
Tip – If you want to deny or delete several devices at once, just select the checkboxes of the devices in question, then, in the list header, click the arrow icon in the Action field and select the respective command from the drop-down menu.
WebAdmin
Opens the user interface (WebAdmin) of the selected device (see
).
Join
Merges two connected devices (see
). The button is only available with offline
devices.
6.1.2 Editing Device Information
Depending on the access privileges a user can be allowed to edit device information.
Note – Changes of the device data will directly be enforced on the devices themselves. For further description of the respective data see UTM documentation, chapter Management >
System Settings.
To edit device information, do the following:
1.
On the Management > Registration page, click the Edit button of the device.
The Edit Device dialog box opens.
2.
Make the following settings:
Device name: Edit the name of the device. The name will be changed on the connected device, too.
Description: Enter an additional description.
Company: Edit the name of the company. The company will be changed on the connected device, too.
SUM V4 Gateway Manager
53
6.1 Registration
6 Management
Hostname: Edit the hostname of the device. The hostname will be changed on the connected device, too.
Custom field: Enter additional information of your choice. Note that you can sort your devices according to the information provided here by means of the
.
SSO mode: Select how the Gateway Manager should connect to the device when using the WebAdmin button.
l
Agent IP: Connection via the agent IP address.
l
Hostname: Connection via the hostname.
l
Public IP: Connection via the public IP address.
l
Manual URL: Connection via the URL entered in the Manual URL text box.
Tip – In the middle of the dialog box, data is displayed which cannot be changed, like product, version number or model. The organizational unit can be changed on the Man-
agement > Organizational Units tab.
City: Edit the device's city. The city will be changed on the connected device, too.
State: Edit the device's state.
Country: Edit the device's country. The country will be changed on the connected device, too.
Longitude/Latitude: Edit the devices geographical location. These values, both in decimal degree notation, are used to position the device onto the
Time zone: Edit the device's time zone. The time zone will be changed on the connected device, too. Be careful when changing the time zone as this will trigger a restart of many services on the remote device. Please refer to the UTM documentation, chapter Man-
agement > System Settings > Time and Date for more information.
GeoIP: Clicking this button will refresh the device's geographic location data based on its
IP address. This is useful, for example, if the IP address has changed in case the device was moved from one office to another located in a different city. However, you can override the information contained in this section. This is useful, for example, if the geographic location data is inaccurate.
54
SUM V4 Gateway Manager
6 Management
6.1 Registration
Note – Most of the information in the Location section is automatically filled in by the geographic location (GeoIP) feature, which is supported by Sophos gateway products
(e.g., UTM, ASG) starting with version ASG 7.300. Some of the information displayed here is also used for sorting devices in the various
. Once you have changed the location information, please note that it takes some time for the tree views and the Worldmap to update their content.
3.
Click Save.
The device data is saved.
Using the controls you can perform further actions on the devices.
6.1.3 Joining Devices
On the Management > Registration tab you can join two devices connected to Sophos
UTM Manager. This feature is useful when the same device is listed twice in the Registration list, for example after reinstalling a previously connected device. During an installation, a device gets a new system ID so that SUM has no possibility to know that the new device is the same as the one before. Thus, two devices will be listed—one offline and one online. You can easily join the two devices, thus merging the two devices into one while restoring all data—global objects, reporting data, and so on.
Note – When you restore a backup including unique site data on the reinstalled device, the previous system ID will be restored and the device is automatically recognized by SUM.
To join two devices, proceed as follows:
1.
On the Registration tab, select the unconnected device and start the joining.
Click the Join button of the respective device.
Note – Only unconnected devices have a Join button.
A wizard window opens. The wizard will guide you through the joining process.
2.
Select the destination gateway.
Drag the destination gateway from the object list into the Select destination gateway field and click Next.
SUM V4 Gateway Manager
55
6.2 Access Control
6 Management
Tip – You can restrict the displayed gateways in the object list either by selecting a specific gateway type from the drop-down list or by means of the search box.
3.
Check the data carefully.
A summary of your selection is displayed. Check the data carefully.
4.
Click Next.
The two devices are being merged.
5.
Click Finish.
The wizard closes and you are redirected to the Registration page. The unconnected device has disappeared from the list.
6.2 Access Control
Within the Management > Access Control menu you can assign monitoring, maintenance, configuration, and administration privileges for each gateway device or organizational unit (OU).
These access rights can be assigned individually for each user.
Note – Users need to be created in the WebAdmin of SUM. It is not possible to create a user in the Gateway Manager itself. Locally created users will be able to change their passwords though, if the User Portal has been enabled via WebAdmin.
The following privileges are available:
Monitoring: A user having the monitoring privilege is permitted to see the general overview of the state of each registered device including its version, current load, license expiration, critical security events, and services. This right permits also access to the web-based GUI of devices as auditor.
Maintenance: Permission to access the submenus and pages on the Maintenance and Management menu. This includes an overview of the device inventory, shutting down gateway devices, rebooting, triggering scheduled operations, deleting/editing devices, and full access to the web-based GUI of Sophos gateway units (called
"WebAdmin").
56
SUM V4 Gateway Manager
6 Management
6.2 Access Control
Configuration: Permission to access the submenus and pages on the Configuration menu. This includes an overview of the currently managed VPNs and global definitions, creating/modifying VPNs and global definitions, disabling/enabling and removing
VPNs, deploying/removing global definitions, as well as viewing specific details of
VPNs. Note the difference between device privileges and organizational unit privileges regarding global definitions: Users with device privileges can deploy/remove but not create/delete global definitions. To have full access a user needs to have organizational unit privileges.
Reporting: Permission to view reporting data in the Reporting submenus and pages and to create on-demand reports.
UserAdmin: A user who has assigned this privilege can propagate privileges for certain devices to other users and/or groups, thereby creating a client-based administratorship. Example: As admin, you give the user jdoe both the Monitoring and
UserAdmin privileges for the device UTM-1. For the UserAdmin privilege, you drag the user jsmith to the Eligible Users and Groups text box and click Apply. When jdoe now logs in to the Gateway Manager, he sees UTM-1 in the Monitoring sections. Additionally, in the Management > Access Control section, he can give monitoring (and
UserAdmin) privileges to jsmith for just the device UTM-1.
Important Note – In your environment, if there is more than one administrator or UserAdmin configured who has the privilege to alter settings or the privileges of normal users, they should take care not to overwrite possible changes of each other. If in doubt, they should reload the
Access Control page before changing rights.
6.2.1 Devices
On the Management > Access Control > Devices tab you can give users privileges for individual devices. If you make use of organizational units (OUs) you might want to consider granting privileges in a groupwise manner (see section Management > Access Control >
To assign a certain device privilege to a user, proceed as follows:
1.
Open the Management > Access Control menu.
The Devices tab is displayed.
SUM V4 Gateway Manager
57
6.2 Access Control
6 Management
2.
Select a user.
Choose the user from the Device Specific Roles For User drop-down list whose privileges you want to change.
3.
Select the device privilege(s).
You can either assign device privileges for all devices or for individual devices only.
Individual devices: Select the checkbox of the device in the column of the privilege you want to assign.
All devices: Select the checkbox in front of the privilege you want to assign for all devices.
Note – The UserAdmin checkbox for a device can only be selected if at least one other privilege checkbox has been selected for this device.
Eligible Users and Groups: If you want to give a user the privilege to assign certain privileges to other users (so-called UserAdmin right) for specific devices, then drag users or groups from the Users object list into this text box.
4.
Click Apply.
Your settings will be saved and instantly applied.
A short status message is displayed at the bottom of the page indicating whether the operation was successful.
Note – You can filter the devices on this page either by Device Name, Country, City, or Org.
Unit to facilitate the selection of certain devices.
The following table shows the mapping between device privileges and access permissions in terms of the SUM menu structure:
Menu/Submenu
Monitoring (all submenus)
Maintenance (all submenus)
Management > Registration
Management > Access Control
Monitoring
Necessary Privilege
Maintenance
Maintenance
Admin; UserAdmin (restricted rights)
58
SUM V4 Gateway Manager
6 Management
6.2 Access Control
Management > Organizational Units
Configuration (all submenus)
Reporting (all submenus)
Admin for any changes
Configuration
Reporting
Note – Only permissions for users can be granted, revoked, or modified. Admins have full access to every area of the Gateway Manager by default, hence their permissions cannot be changed.
6.2.2 Organizational Units
On the Management > Access Control > Organizational Units tab you can give users privileges for whole OUs. If you need to assign privileges in a more fine-grained manner, you can assign privileges also device-based (see section Management > Access Control >
).
Assigning privileges for whole OUs means, that users with that privilege can monitor, maintain, configure, or administrate all devices that are part of the respective OU.
The mapping between privileges and access permissions is the same as for devices. The mapping table can be viewed in the Management > Access Control >
section.
To assign a certain OU privilege to a user, proceed as follows:
1.
Open the Management > Access Control > Organizational Units tab.
2.
Select a user.
Choose the user from the Device Specific Roles For User drop-down list whose privileges you want to change.
3.
Select the OU privilege(s).
You can either assign OU privileges for all OUs or for individual OUs only.
Individual OUs: Select the checkbox of the OU in the column of the privilege you want to assign.
All OUs: Select the checkbox in front of the privilege you want to assign for all OUs.
Note – The UserAdmin checkbox for an OU can only be selected if at least one other privilege checkbox has been selected for this OU.
SUM V4 Gateway Manager
59
6.3 Organizational Units
6 Management
Eligible Users and Groups: If you want to give a user the privilege to assign certain privileges to other users (so-called UserAdmin right) for specific OUs, then drag users or groups from the Users object list into this text box.
4.
Click Apply.
Your settings will be saved and instantly applied.
A short status message is displayed at the bottom of the page indicating whether the operation was successful.
This icon is displayed on the Devices tab next to the respective checkbox when a certain user has Organizational Units privileges for the device.
Note – You can filter the OUs on this page either by Org. Unit, Info, Comment, or the number of Devices to facilitate the selection of certain OUs.
6.3 Organizational Units
On the menu Organizational Units you can create and manage so-called organizational units
(OU).
All devices that are managed by your Sophos UTM Manager may be organized in organizational units. Such an organization can be especially useful when your SUM manages lots of devices which belong to different organizations or companies. The idea behind organizational units is that you organize your devices in groups, i.e. you assign some devices to a certain organizational unit. Typically, a name for an organizational unit may be the name of the company it belongs to. But that is in no way obligatory. You can organize your devices freely according to your needs. OUs enable you to restrict the displayed devices (or related items) to those which are assigned to the selected OU, so that you gain a better overview and that you are able to perform certain actions on devices of the selected OU simultaneously in a convenient manner.
The workflow is as follows:
1.
Create an OU.
2.
Assign devices to be part of that OU.
3.
Use the drop-down menu Organizational Unit to restrict the displayed devices (or related items) to those devices only that are part of the selected OU.
60
SUM V4 Gateway Manager
6 Management
6.3 Organizational Units
Example: Create an OU called Example Corp. Then assign the devices UTM_1 and UTM_2 to that OU. Assume that UTM_3 is not assigned to any OU. On the Monitoring page, when you now select Example Corp. from the drop-down menu Organizational Unit you will be only displayed UTM_1 and UTM_2. Selecting All from the drop-down menu afterwards will bring additionally the device UTM_3 back on display.
Info: The Info button is visible only to normal users. Clicking it opens an information window
Organizational Unit which displays the OU's name, the comment, the custom field, and the devices that are assigned to the OU.
Default: Each OU has a button called Default which is, however, only visible to the user admin.
The default OU, which is by default the Global OU, is the OU to which all newly registering devices are automatically assigned to. Of course, each device can be manually assigned to another OU afterwards.
6.3.1 Creating Organizational Units
Only the user admin is allowed to create organizational units. For all other users, regardless of their other privileges, the button New Organizational Unit is disabled. To create an organizational unit, do the following:
1.
On the page click New Organizational Unit.
The Create New Organizational Unit dialog box opens.
2.
Make the following settings:
Unit name: Enter a descriptive name for the OU.
Comment (optional): Add a description or other information.
Custom field: You can enter additional information here, e.g. email address and telephone number of the administrator.
Auto deployment: Select this option if you want global definitions to be automatically deployed to the associated devices.
Note – Auto deployment does not take place for firewall rulesets, PAC files, and filter actions. The reason is that you can have several such definitions for the same OU, but as only one definition can be applied (as default) on the target device, you need to deploy those definitions manually.
SUM V4 Gateway Manager
61
6.3 Organizational Units
6 Management
Auto substitution: Only available if Auto deployment is selected.
There are two scenarios where you might want to use substitution: (1) If there are local definitions on the target devices which you want to convert into global definitions. (2) A deployment has taken place in the past and in the meantime SUM had lost connection to the device(s) you are going to deploy the objects to. For, if there already had been a connection before with objects deployed, those objects still exist on the device(s) (if they have not been deleted) and you may want to re-enable them to be again global SUM objects instead of local objects, which cannot be managed by SUM.
From the drop-down list select whether a substitution should take place when Name and
Data correspond or when Data Only corresponds.
Note – If you do not select a substitution method and deploy a global object to a device where an object with the identical name already exists, the deployed object's name on the device will be appended a random 4-character suffix in square brackets. On the
Gateway Manager it will keep its original name.
Devices: Add one or more devices that are to be part of the OU. For that, click the Folder icon and drag an object from the Devices object lists on the left into the field.
Update interval: Whereas persistent changes on your connected devices will immediately be reported to the Gateway Manager, other monitoring data is being updated on a regular basis. By default, 30 seconds is the minimum time interval between two monitoring data updates. To reduce traffic you can increase the minimum update interval up to 180 seconds.
3.
Click Save.
The OU appears in the list of organizational units.
To either edit or delete an OU, click the corresponding buttons. The OU Global, however, cannot be deleted.
A device can always only be part of one OU. That means if you assign a device to an OU, it is going to be removed from the OU it was part of until then.
6.3.2 The Global Organizational Unit
The organizational unit Global is a default OU, which means that it cannot be deleted, as there always has to be an OU where newly connecting devices can be automatically assigned to. Addi-
62
SUM V4 Gateway Manager
6 Management
6.4 Notifications tionally, it has the feature of being shared, which means that users can see its devices when they have the right to see and work with global devices and/or objects.
6.4 Notifications
On the Management > Notifications page you can configure notification settings. You can define that for certain events notifications are sent to selected recipients. Notification settings can be configured per organizational unit. By default, notifications are turned off.
To enable notifications for a certain organizational unit, do the following:
1.
Click the Notifications button of an OU.
The dialog window Change Notifications Settings for OU opens.
2.
Add recipients.
Add one or more recipients to the Notification Recipients box.
3.
Unselect unwanted notifications.
By default, all types of notifications are selected in the Notification Selection table. If you do not want to receive all kinds of notifications, unselect those types of notifications you do not want to be sent.
4.
Click Save.
Your settings will be saved and you will start receiving configured notifications.
5.
Activate notifications.
Click the green toggle-switch next to an OU to activate notifications.
You can click the Info button of an OU to see which recipients and notifications are configured for the respective OU.
Note – IPsec notifications are only sent for tunnels that have been deployed from SUM.
Tip – You can view all events (if there are any) in the Event Log menu.
6.5 Event Log
On the Management > Event Log tab you can view log data of the organizational units you have maintenance privileges for. You can specify how many days log events should be stored in the database. Finally you can delete log data.
SUM V4 Gateway Manager
63
6.5 Event Log
6 Management
Tip – On the Notifications tab you can configure the log data to be sent via email.
Setting the Number of Days to Store Log Data
Days before expiration: Select how many days event log data should be stored in the database until it will be deleted.
Displaying Event Log Data
To display event log data, proceed as follows:
1.
Specify the time period for which you want to display the event logs.
In the Start date line, click the Calendar icon and select the date from the calendar. Specify the time using the Start time drop-down list.
Use the End date and End time fields accordingly.
2.
Click Apply.
The event logs matching the defined time period will be displayed in the Event Log Data section.
Tip – You can sort all data by clicking the table column headers.
You can change the information displayed to be more selective by means of the Filter Bar, which is the first row below the table header: l
Time: You can type (a part of) the time stamp into this search box to restrict the displayed event logs to those whose time correspond.
l
Type: You can restrict the displayed event logs to those of a certain type.
l
Message: You can restrict the displayed event logs to those with a certain message.
l
Device Names: You can type (a part of) a device's name into this filter to restrict the displayed event logs to those which are related to this device.
Deleting Event Log Data
Clear: Deletes all event log data from the list and from the database.
64
SUM V4 Gateway Manager
6 Management
6.6 MSP
6.6 MSP
With the Sophos MSP program, you gain access to monthly licensing and granular billing on a per-user basis for your installations. The MSP licensing lets you easily deploy and manage licenses and the subscriptions of UTMs connected to your Sophos UTM Manager (SUM). For every gateway unit that is managed via this MSP system, you can enable and disable subscriptions and modify the number of allowed units or endpoint clients with a few clicks in the
SUM at any time. The system provides a completely automated monthly-billing mechanism which will automatically distribute new keys to your devices. This removes the need to manually manage licenses and allows you to onboard customers as an MSP much faster than with traditional sales paid up front. The system allows instant customer-specific changes without the need to download or install licenses. Additionally, MSP licensing offers flexible expiration times and granular usage accounting down to the exact day for each managed device.
To enable the MSP licensing feature on the SUM, your MyUTM account has to have MSP licensing activated. This is done by officially enrolling in the MSP program by contacting your Sophos sales representative who can explain the requirements and details. Once you have completed the MSP program entry process, you will be able to join Sophos UTM Manager to the MSP backend using your MyUTM credentials and from there the MSP licensing system inside SUM will be operational, allowing you to begin deploying licenses to your managed installations.
6.6.1 Licensing
The MSP > Licensing tab shows a list of all connected gateway units with MSP licensing activated. Here you can enable and disable subscriptions for each gateway unit and modify the number of allowed users or endpoints. Note that for any changes, the gateway unit has to be online, otherwise an error message appears. Information about changes can be found on the Log tab.
To edit the licensing settings of a listed gateway unit proceed as follows:
1.
Click the Edit button of the respective gateway unit.
The Edit MSP Licensing Parameters dialog box opens.
2.
Make the following settings:
Size: Enter the number of allowed users. Defining an unlimited number is not possible.
The number of users is only used for accounting purposes—on the respective gateway unit the number of allowed users will always be unlimited.
SUM V4 Gateway Manager
65
6.6 MSP
6 Management
Bundles: If selected, the FullGuard license is activated. This license automatically enables all features except from Endpoint Protection, which can be activated additionally.
Features: These options represent the six subscriptions available for the UTM. A detailed description of the subscriptions and the features included is available on the Man-
agement > Licensing page of the UTM documentation. If you activate Endpoint Protection, you need to specify the number of allowed endpoints additionally. The number of endpoints is only used for accounting purposes—on the respective gateway unit the number of allowed endpoints will always be 10000 if Endpoint Protection is enabled.
Options: This area gives an overview of the high availability and cluster features available for the gateway unit. Automatically, both high availability and cluster are enabled and
10 cluster nodes are allowed. These settings cannot be changed.
3.
Click Save.
Your settings will be saved. The selected subscriptions and options will immediately be deployed to the gateway unit.
6.6.2 Activation
On the MSP > Activation tab, you can activate or deactivate MSP licensing for all or individual connected gateway units. Note that for any changes, a gateway unit has to be online.
The icon in the MSP column of the displayed table shows if MSP licensing is activated for a gateway unit or not.
Activating MSP Licensing for a Gateway Unit
To activate MSP licensing for a gateway unit, proceed as follows:
1.
In the MSP column of the respective gateway unit, click the red cross icon.
Tip – To activate several gateway units at once, activate the checkboxes of the respective gateway units. Or you can activate the checkboxes of all gateway units by clicking the checkbox to the left of the table header. Then, in the Action drop-down in the control panel above the table, select Activate MSP.
A security message opens.
2.
Confirm with OK.
The MSP licensing will be activated for the selected gateway unit(s).
66
SUM V4 Gateway Manager
6 Management
6.6 MSP
Note – As soon as you enable MSP licensing for a connected gateway unit, a FullGuard license with a limit of one user will be deployed to the respective gateway unit. To enable or disable subscriptions, you can continue on the MSP > Licensing tab.
Deactivating MSP Licensing for a Gateway Unit
If you deactivate MSP licensing for a gateway unit, all subscriptions will immediately be disabled, and the unit will have the same license status as a machine after expiration of a 30-day trial license.
To deactivate MSP licensing for a gateway unit, proceed as follows:
1.
In the MSP column of the respective gateway unit, click the green checkmark icon.
Tip – To deactivate several gateway units at once, activate the checkboxes of the respective gateway units. Or you can activate the checkboxes of all gateway units by clicking the checkbox to the left of the table header. Then, in the Action drop-down in the control panel above the table, select Deactivate MSP.
A security message opens.
2.
Confirm with OK.
The MSP licensing will be deactivated for the selected gateway unit(s).
Note – It is not possible to deactivate MSP licensing for an offline gateway unit. In case that you want to deactivate MSP licensing for an offline gateway unit, e.g. because the unit is broken, you have to delete it altogether on the Management > Registration tab.
6.6.3 Authentication
On the MSP > Authentication tab you can enable MSP licensing. To be able to do so, your
Sophos Certified Partner first has to activate MSP licensing for your MyUTM account.
To enable MSP licensing, do the following:
1.
On the Authentication tab, enable MSP licensing.
Click the toggle switch.
The toggle switch turns amber and the Credentials area becomes editable.
SUM V4 Gateway Manager
67
6.6 MSP
6 Management
2.
Enter your MyUTM credentials.
Enter the email address and password you use to access your MyUTM account on the
MyUTM portal. Note that MSP licensing has to be activated for your MyUTM account by your Sophos NSG Certified partner.
3.
Click Apply.
SUM now connects to the Sophos servers to validate your rights and to exchange certificates. This can take up to 60 seconds. Then the toggle switch turns green to indicate that MSP licensing is active.
Directly after enabling MSP licensing, it is not yet activated for any gateway unit. You can now continue by enabling MSP licensing for individual connected gateway units on the
Activation tab.
If valid authentication credentials entered the Account Information part is displayed with the following information: l
Authenticated Email Address: Email address which was entered in the credentials.
l
Certificate Expiration Date: Date the certificate expires.
If there is a problem with the certificate which is used for authentication against the licensing portal, SUM sends email notifications of the type 'system'. These notifications will be send to the administrator which is defined in First Steps >
.
If the certificate exchanged between SUM and license portal either expires, or gets corrupt, or is deleted, authentication fails. In this case, enter your MyUTM credentials again and click the
Reauthenticate button. A new certificate will be exchanged.
6.6.4 Log
On the MSP > Log tab you can view log data of the gateway units managed by MSP licensing.
You can specify the time period of the displayed log entries.
To display MSP licensing log data, proceed as follows:
1.
Specify the time period for which you want to display MSP licensing logs.
In the Start date line, click the Calendar icon and select the date from the calendar. Specify the time using the Start time drop-down list.
Use the End date and End time fields accordingly.
68
SUM V4 Gateway Manager
6 Management
6.6 MSP
2.
Click Apply.
The MSP licensing logs matching the defined time period will be displayed in the MSP
Licensing Log Data section.
Tip – You can sort all data by clicking the table column headers. When hovering the mouse cursor on a cell, a tooltip appears showing detailed information of the displayed data.
You can change the information displayed to be more selective by means of the Filter Bar, which is the first row below the table header: l
Device Name: You can type (a part of) a device's name into this filter field to restrict the displayed MSP licensing logs to those which are related to this device.
l
Time: You can type (a part of) the time stamp into this filter field to restrict the displayed
MSP licensing logs to those whose time correspond.
l
Action: You can type (a part of) the time stamp into this filter field to restrict the displayed
MSP licensing logs to those with a certain action.
l
Status: You can restrict the displayed MSP licensing logs to those with a certain status.
There are three statuses: l
Success: Change was effective on the gateway unit and reported to MyUTM.
l
Pending: Change was effective on the gateway unit, reporting to MyUTM still pending.
l
Failed: Change was not successful.
l
Message: You can restrict the displayed MSP licensing logs to those with a certain message.
l
Features: You can restrict the displayed MSP licensing logs to those reflecting feature or option changes where the respective gateway unit has a certain number of features or options.
6.6.5 License Portal
On the MSP > License Portal tab you can check the connection between SUM and the license portal. Time stamps of the last successful connection and the last connection attempt are displayed.
Click the Check Connection button to execute a connection check.
If the connection fails for a significant time, there can be several reasons, e.g.:
SUM V4 Gateway Manager
69
6.6 MSP
6 Management
l
Your network settings (e.g., DNS settings, firewall rules) might prohibit the SUM connection to the license portal. Please check and make sure that SUM can reach the license portal.
l
The license portal may be offline. Please contact Sophos Support, if the problem persists for a long time.
l
Local daemon problems may occur. Details can be found in the SUM core daemon log data, which can be accessed in the SUM WebAdmin, on the Logging & Reporting > View
Log Files tab.
70
SUM V4 Gateway Manager
7 Configuration
The Configuration menu consists of several sections where you can create so-called global objects. Those are objects centrally created on the SUM which can be deployed to managed devices to be used there.
First there is the Overview section where the most important configuration information is displayed for devices. In the Import section you can import different types of objects from devices to use them on other devices. In the Definitions section you can create network definitions, service definitions, and time period definitions. In the Firewall section you can create firewall rules and rulesets. In the Web Filtering section you can define web filter actions, filter categories, exceptions, and PAC files. In the VPN section you can define virtual private networks. In the Endpoint
Protection section you can define antivirus policies and device control policies.
However, this chapter starts with important information on creating global objects with SUM and the consequences for the managed devices.
The following topics are included in this chapter: l
l
l
l
l
l
l
l
Configuration Icons
The following table provides an overview of icons used in the Configuration section of Gateway
Manager.
Displays where the definition is in use, i.e. where it is deployed to.
7.1 SUM-Created Objects
7 Configuration
Displays diverse details of a definition where applicable, e.g. group members or contained rules.
Displays on which devices a definition is set.
Auto deployment: The device or definition is automatically deployed.
Number of devices where deployment was successful.
Number of devices where an error occurred during deployment.
Number of devices not connected to SUM (offline).
Number of devices where deployment is pending.
Name of associated organizational unit (OU).
7.1 SUM-Created Objects
Several object definitions such as networks, hosts, and policies will be created on remote devices when using SUM for central configuration. Such objects differ from those directly created on a device by a local administrator. SUM-created objects cannot be removed or modified locally, but only viewed by the local administrators. SUM objects can be used in local configurations like any other object definition on the respective device, but it is important to be aware of the fact, that these objects are centrally managed and adjusted. This can have the following consequences: l
Meaning or attribute change of an object:
A network object from SUM could suddenly have a new address/netmask.
This would affect any dependent object or configuration the SUM object is referenced in.
For example, the meaning of a firewall rule could change if the respective SUM object is used here.
l
Removal of an object by SUM:
A VPN could be deleted in SUM and subsequently dependent network objects would be removed.
l
Any local configurations depending on the removed SUM object will not be invalidated.
l
A local copy of the removed SUM object will act as a stand-in in those configurations.
72
SUM V4 Gateway Manager
7 Configuration
7.1 SUM-Created Objects
7.1.1 Identifying SUM Objects
It is possible to view SUM-created objects within the various WebAdmin definition menu pages of the remote device. The objects in question are easy to identify as they lack the common control buttons visible for local objects, like Edit and Delete.
7.1.2 Releasing SUM Objects
There is a manual release button accessible in the WebAdmin of remote devices, should a need arise to remove SUM-created objects on a particular device. It is located in the Management >
Central Management menu starting with V7.4 of the gateway product line. The SUM Objects area is only visible if there are objects that have been created via a SUM and if this SUM is now disconnected from a device. SUM-created objects can be network definitions, remote host definitions, IPsec VPN tunnels, etc.
The button Release Objects can be clicked to release any objects that were created by SUM the device has formerly been managed with. These objects are normally locked and can only be viewed on the local device. After clicking the button, the objects become fully accessible and can be reused or deleted by a local administrator.
Note – In case former SUM-created objects are released, they can be re-converted to global objects during a new deployment process by means of the substitution option. See section
Deploying Global Objects.
7.1.3 Global Objects
A subgroup of SUM-created objects are so-called global objects. Those are objects which can be explicitly created and then deployed to more than one managed device. Examples for global objects are the rules and objects you can create under Definitions, Firewall, and Web Filtering.
The usage of global objects is much more convenient than creating the same object individually on every device. Especially, when something of an object changes, like e.g. the IP address, you only have to apply the change once: on the global object.
Global definitions are created and deployed to devices as follows: First, you create a global object and assign it to a certain organizational unit (OU). After that, you deploy that global object by means of the button Deploy which will start a wizard which will guide you comfortably through
SUM V4 Gateway Manager
73
7.1 SUM-Created Objects
7 Configuration
the deployment process. As soon as the wizard has been successfully completed, the global object can be used in configurations of the devices to which it has been deployed.
Global objects can of course be removed again. If you remove a PAC file or a firewall ruleset from a managed device you can decide to keep a local copy or to restore the default settings.
With all other global objects, the respective object on a device is only deleted if it is unused on the respective device. Otherwise it is not deleted but becomes independent of the global object.
Removing, too, is done via a wizard which guides you through the process.
Important – As they are directly linked to organizational units, global objects can only be created by a user who has OU configurational privileges (Organizational Units tab)—having device configurational privileges (Devices tab) is not sufficient! However, having (only) device privileges is sufficient for a user to be able to use existing global objects for their devices, i.e.
deploying and removing global objects to/from their devices.
The three actions that can be carried out on global objects—deploying to one or more devices, removing from one or more devices, and deleting—are explained in detail in the following sections.
7.1.3.1 Deploying Global Objects
First of all, it is important to keep in mind that global objects are bound to their organizational units, which is the reason why an object of a certain OU can only be deployed to devices of the same OU. You can always move devices around between OUs but you cannot change the OU of a global object.
Tip – If you want to deploy definitions of just one OU, then, before starting the deployment process, select the corresponding OU from the Organizational Unit drop-down menu. Then only the relevant devices will be displayed in the Devices object list which is much more comfortable if you are managing lots of devices.
To deploy one or multiple global objects, do the following:
1.
Open the tab with the objects you want to deploy.
For example, to deploy network definitions open the Configuration > Definitions > Net-
works tab.
2.
Start the deploying for the object(s) you want to deploy.
To deploy one object, click the button Deploy of the respective object.
To deploy multiple objects (not available for PAC files and firewall rulesets), select their
74
SUM V4 Gateway Manager
7 Configuration
7.1 SUM-Created Objects checkbox. Then, in the list header, click the arrow icon in the Action field and select the
Deploy to gateway(s) command from the drop-down menu.
A wizard window opens. The wizard will guide you through the deployment process.
3.
Check and modify your object selection, if necessary.
Note – This step is only available if multiple object deployment is allowed for the object type you selected.
By default, the objects listed are those you selected in the previous step. However, you can add additional objects from the object list on the left side, where all available objects are listed.
l
Select a substitution method (optional):
Note – This option is not available for PAC file and firewall ruleset deployment.
There are two scenarios where you might want to use substitution: (1) If there are local definitions on the target devices which you want to convert into global definitions. (2) A deployment has taken place in the past and in the meantime SUM had lost connection to the device(s) you are going to deploy the objects to. For, if there already had been a connection before with objects deployed, those objects still exist on the device(s) (if they have not been deleted) and you may want to reenable them to be again global SUM objects instead of local objects, which cannot be managed by SUM.
From the drop-down list select whether a substitution should take place when
Name and Data correspond or when Data Only corresponds.
Note – If you do not select a substitution method and deploy a global object to a device where an object with the identical name already exists, the deployed object's name on the device will be appended a random 4-character suffix in square brackets. On the Gateway Manager it will keep its original name.
4.
Click Next.
The next wizard step is displayed.
SUM V4 Gateway Manager
75
7.1 SUM-Created Objects
7 Configuration
5.
Select gateways.
Select one or more gateways from the object list on the left where you want to deploy the global object(s) to. Simply drag them one after the another to the Gateways box.
Important – Only those devices are displayed which support the type of object you want to deploy. In addition, you can in principle select all devices but the objects are going to be deployed only to those devices which are assigned to the same OU as the objects.
Note that you can restrict the displayed gateways in the Devices object list either by selecting a specific gateway type from the drop-down list or by means of the search box.
6.
Click Next.
A summary of your selections is displayed. If you had selected devices in the previous step that do not share the same OU as the object(s), those devices will be automatically removed and therefore not be displayed in the summary.
7.
Click Next.
The deployment is being performed.
8.
Click Finish.
The wizard closes and you are redirected to the initial page, respectively.
The four icons at the bottom of the respective object show how many devices it has been successfully deployed to, whether a deployment process is pending, and if any errors occurred.
Additionally, you can see how many devices are offline.
Note – You can also include devices into the deployment process that are currently offline.
The object(s) are going to be deployed to offline devices as soon as they come back online.
7.1.3.2 Removing Global Objects
Global objects can be removed again, either from singular devices or from all devices. The removal process is supported by a wizard.
If you remove a PAC file or a firewall ruleset from a managed device you can decide to keep a local copy or to restore the default settings. For all other global objects what is going to happen on a managed device depends on the object usage. There are two scenarios possible:
76
SUM V4 Gateway Manager
7 Configuration
7.1 SUM-Created Objects l
Object is unused: The object is not part of a configuration on the managed device.
Then the object definition will be deleted on the device.
l
Object is in use: The object is used in one or more configuration(s) on the managed device. Then the object definition will be converted to a local object definition and stays valid in all its configurations. However, as being a local object, it can no longer be managed by SUM.
Note – Local objects can be re-converted to global objects during a new deployment process by means of the substitution option. See section Deploying Global Objects.
To remove a global object, do the following:
1.
Open the tab with the objects you want to remove.
For example, to remove network definitions open the Configuration > Definitions > Net-
works tab.
2.
Select the objects you want to remove.
To remove one object, click the button Remove of the respective object.
To remove multiple objects (not available for PAC files and firewall rulesets), select their checkbox. Then, in the list header, click the arrow icon in the Action field and select the
Remove from gateway(s) command from the drop-down menu.
A wizard window opens. The wizard will guide you through the removal process.
3.
Check and modify your object selection, if necessary.
Note – This step is only available if multiple object deployment is allowed for the object type you selected.
By default, the objects listed are the ones you selected in the previous step. However, you can add additional objects from the object list on the left side, where all available objects are listed.
4.
Click Next.
The next wizard step is displayed.
5.
Select gateways.
Select one or more gateways from the object list on the left where you want to remove the global object(s) from. Simply drag them one after the another to the Gateways box.
SUM V4 Gateway Manager
77
7.1 SUM-Created Objects
7 Configuration
Important – Only those devices are displayed which support the type of object you want to remove. In addition, you can in principle select all devices but the objects are going to be removed only from those devices which are assigned to the same OU as the objects and which use (one of) the selected object(s).
Note that you can restrict the displayed gateways in the Devices object list either by selecting a specific gateway type from the drop-down list or by means of the search box.
6.
Click Next.
Only for firewall rulesets and PAC files the step Select Treatment Procedure is displayed where you define what to do with the object on the remote gateway(s): l
Keep as local copy: The object will remain on the remote gateway. In case of a firewall ruleset, the firewall rules contained in the ruleset will be transformed into local firewall rules.
l
Restore configuration default: The deployed object will be removed from the remote gateway and the configuration default will be restored.
7.
Click Next.
A summary of your selections is displayed. If you had selected devices in the previous step that do not share the same OU as the object(s) or do not contain the object(s), those devices will be automatically removed and therefore not be displayed in the summary.
8.
Click Next.
The removal is being performed.
9.
Click Finish.
The wizard closes and you are redirected to the initial page, respectively.
The first icon at the bottom of the corresponding global object(s) shows whether all your removals could be performed. If you have removed an object from all devices, the number should be zero now. If you have removed an object only from some devices, the number should reflect this.
7.1.3.3 Deleting Global Objects
Global objects can be deleted which means that the definition is deleted from SUM. If the global object is still deployed to one or more devices when you click the Delete button, the global definition will be removed from the device(s) and deleted from SUM in one step. However, firewall rulesets and PAC files have to be removed before you can delete them.
78
SUM V4 Gateway Manager
7 Configuration
7.2 Overview
To delete one or multiple global objects, do the following:
1.
Open the tab with the objects you want to delete.
For example, to delete network definitions open the Configuration > Definitions > Net-
works tab.
2.
Select the objects you want to delete.
To delete one object, click the button Delete of the respective object.
To delete multiple objects, select their checkbox. Then, in the list header, click the arrow icon in the Action field and select the Delete definition(s) command from the drop-down menu.
A dialog window opens where you are being asked to either confirm or abort the process.
3.
Confirm the deletion.
Click OK to confirm the deletion of the selected objects.
The selected objects will be deleted from SUM. If an object was deployed to one or more devices, the object will be simultaneously removed from those devices while the object definition on those devices will be transformed into a local object.
In case devices affected by the deletion are offline, the process is going to be completed as soon as the device comes back online.
7.2 Overview
On the Configuration > Overview page you can see the most important configuration information of all managed devices. You can see which features are supported by a certain device and all configurations that have been deployed via SUM, which comprises networks, services, time period definitions, firewall rules, web filter definitions, IPsec tunnels, and endpoint protection policies.
When you double-click a device, the Configuration Overview Details page is displayed where you find additional information, e.g. administration roles that apply for the device or the names of the deployed objects.
7.3 Import
On the Configuration > Import pages you can import objects from connected gateways into
SUM. You can for example import network definitions, service definitions, firewall rules, or web filtering actions. There is no difference between imported objects and manually created
SUM V4 Gateway Manager
79
7.3 Import
7 Configuration
objects—imported objects have no link to the original gateway, and they can be edited and deployed like any manually created object.
7.3.1 Type Selection
On the Configuration > Import > Type Selection tab you pre-select the data to be imported. You can select the gateway(s) you want to import from and define the global object types you want to consider for import.
To define the data to be selected, proceed as follows:
1.
In the Gateways box, add the gateway(s) you want to import data from.
2.
Select the object types matching the objects you want to import.
Note – When you import a firewall rule of multiple sources, services, or destinations, the rule will be imported and converted to only match the first source, service, and destination.
3.
Click Apply.
The Gateway Manager collects the data matching your selection criteria from the devices. If a selected object depends on another object which is not available in the Gateway Manager (e.g., firewall rules depend on network and service definitions), the Gateway Manager collects this data, too. All collected individual objects will be added to the list of objects displayed on the Import tab. There you can specify the individual objects to be imported, and eventually start the import.
If one or more objects cannot be imported, a dialog window opens, listing these objects and the respective reasons. For example, you cannot import firewall rules based on interface objects.
Confirm the dialog window with OK. Objects causing errors will not be listed on the Import tab.
7.3.2 Import
The Configuration > Import > Import tab contains a list of objects. Here you can select the individual objects you want to import into SUM. To add objects to the list, you pre-select them on the
Import > Type Selection tab.
Tip – The list is persistent, that means it will remain unchanged until you explicitly delete the listed objects. You can delete individual objects from the list with the respective Delete button or
80
SUM V4 Gateway Manager
7 Configuration
7.4 Definitions use the Delete All button to clear the list. Deleting only removes the objects from the list, it has no effect on the objects themselves.
To import objects, proceed as follows:
1.
On the Type Selection tab, specify the data to be imported.
The respective objects will be added to the Import tab.
2.
On the Import tab, select the objects you want to import.
You can use the drop-down lists and the search box on top of the list to filter the displayed objects.
Select the checkbox of the objects you want to import.
3.
Click the Import button.
The selected objects are imported into SUM and disappear from the Import list.
7.4 Definitions
In the section Configuration > Definitions you can create global definitions of the type network, service, and time period. Those definitions can be used by more than one device, for example a mail server host object or an OpenVPN service.
7.4.1 Networks
On the Configuration > Definitions > Networks tab you can create global network definitions.
These objects can subsequently be used for all devices sharing the same organizational unit
(OU). That means, you create a single object which you can then deploy to one or more devices of the OU the object is assigned to.
Tip – When you click on the Info icon of a network definition in the Network Definitions list, you can see all configuration options in which the network definition is used.
To create a new global network definition, do the following:
1.
On the Networks tab, click New Network Definition.
The dialog box Create New Network Definition opens.
SUM V4 Gateway Manager
81
7.4 Definitions
7 Configuration
2.
Make the following settings:
Name: Enter a descriptive name for the network definition.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) to which the network definition is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this global definition. For information on how to define
OUs, please see chapter Management >
Type: Select a network definition type from the drop-down list. The following network definition types are available: l
Host l
DNS Host l
DNS Group l
Network l
Range l
Multicast Group l
Network Group l
Availability Group
For a detailed description of those network definition types and the information you need to provide for them (such as Address or Hostname) please refer to your UTM Administration Manual or Online Help.
IPv4 Address: Enter the IP address of the interface (note that you cannot enter the IP address of a configured interface).
Netmask: Select a network mask.
IPv6 Address: Enter the IP address of the interface (note that you cannot enter the IP address of a configured interface).
Netmask: Enter an IPv6 network mask.
3.
Click Save.
The new network definition is displayed on the Networks page.
82
SUM V4 Gateway Manager
7 Configuration
7.4 Definitions
To either edit or delete a network definition, click the corresponding buttons. You can also clone network definitions, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy command you can deploy one or more network definitions to your devices. If you want to undo the deploying, you can use the Remove command. If you delete a network definition, it will simultaneously be deleted from the devices it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
Network definitions deployed to a device can easily be identified on the target device as they can neither be edited nor deleted on the device thus only having a View button.
7.4.2 Services
On the Configuration > Definitions > Services tab you can create global service definitions.
These objects can subsequently be used for all devices sharing the same organizational unit
(OU). That means, you create a single object which you can then deploy to one or more devices of the OU the object is assigned to.
To create a new service definition, do the following:
1.
On the Services tab, click New Service Definition.
The dialog window Create New Service Definition opens.
2.
Make the following settings:
Name: Enter a descriptive name for the service definition.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) to which the service definition is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this global definition. For information on how to define
OUs, please see chapter Management >
.
Type of Definition: Select a service definition type from the drop-down list. The following service definition types are available: l
TCP l
UDP l
TCP/UDP l
ICMP
SUM V4 Gateway Manager
83
7.4 Definitions
7 Configuration
l
IP l
ESP l
AH l
Group
For a detailed description of those service definition types and the information you need to provide for them (such as ports) please refer to your UTM Administration Manual or
Online Help.
3.
Click Save.
The new service definition is displayed on the Services page.
To either edit or delete a service definition, click the corresponding buttons. You can also clone service definitions, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy command you can deploy one or more service definitions to your devices. If you want to undo the deploying, you can use the Remove command. If you delete a service definition, it will simultaneously be deleted from the devices it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
Service definitions deployed to a device can easily be identified on the target device as they can neither be edited nor deleted on the device thus only having a View button.
7.4.3 Time Period Definitions
On the Configuration > Definitions > Time Period Definitions tab you can create global time period definitions. These objects can subsequently be used for all devices sharing the same organizational unit (OU). That means, you create a single object which you can then deploy to one or more devices of the OU the object is assigned to.
To create a new time period definition, do the following:
1.
On the Time Period Definitions tab, click New Time Period Definition.
The dialog window Create New Time Period Definition opens.
2.
Make the following settings:
Name: Enter a descriptive name for the time period definition.
Comment (optional): Add a description or other information.
84
SUM V4 Gateway Manager
7 Configuration
7.4 Definitions
Org. Unit: Select the organizational unit (OU) to which the time period definition is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this global definition. For information on how to define
OUs, please see chapter Management >
.
Type: Select the time period definition type. The following types are available: l
Recurring Event: These events will be repeated periodically. You can select the start time, the end time, and the weekdays on which the time period definition should be applied. Start and stop dates cannot be selected for this type. The concrete times and weekdays will be listed below if selected.
l
Single Event: These events will only take place once. You can both select a start date/time and an end date/time. As these definitions do not recur, the option Week-
days cannot be selected for this type.
3.
Click Save.
The new time period definition is displayed on the Time Period Definitions page.
To either edit or delete a time period definition, click the corresponding buttons. You can also clone time period definitions, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy command you can deploy one or more time period definitions to your devices. If you want to undo the deploying, you can use the Remove command. If you delete a time period definition, it will simultaneously be deleted from the devices it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
Time period definitions deployed to a device can easily be identified on the target device as they can neither be edited nor deleted on the device thus only having a View button.
7.4.4 MAC Address Definitions
The Definitions & Users > Network Definitions > MAC Address Definitions tab is the central place for defining MAC address definitions, i.e., lists of MAC addresses. A MAC address definition can be used like a network definition. Additionally it can be used to further restrict a rule based on hosts/IP addresses to only match devices which have one of the defined
MAC addresses.
Tip – When you click on the Info icon of a MAC address definition, you can see all configuration options in which the definition is used.
SUM V4 Gateway Manager
85
7.5 Firewall
7 Configuration
To create a MAC address definition, proceed as follows:
1.
On the MAC Address Definitions tab, click New MAC Address Definition.
The Create new MAC Address Definition dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for this definition.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) to which the MAC address definition is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the
OU cannot be changed afterwards for this global definition. For information on how to define OUs, please see chapter Management >
MAC Addresses: Click the Plus icon to enter individual MAC addresses subsequently or use the Action icon to import a list of MAC addresses via copy and paste. The MAC addresses are usually specified in a format consisting of six groups of two hexadecimal digits, separated by colons or hyphens (e.g., 00:04:76:16:EA:62).
Hosts: Add or select the hosts whose MAC addresses you want to add to the
MAC address definition.
Note – You can either enter MAC addresses or hosts or both.
3.
Click Save.
The new definition appears on the list.
To either edit or delete a MAC address definition, click the corresponding buttons.
With the Deploy command you can deploy one or more time period definitions to your devices. If you want to undo the deploying, you can use the Remove command. If you delete a time period definition, it will simultaneously be deleted from the devices it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
MAC Address definitions deployed to a device can easily be identified on the target device as they can neither be edited nor deleted on the device thus only having a View button.
7.5 Firewall
In the Configuration > Firewall section you can centrally define global objects such as firewall rules and rulesets to be used by your managed devices.
86
SUM V4 Gateway Manager
7 Configuration
7.5 Firewall
7.5.1 Firewall Rules
On the Firewall > Firewall Rules tab you can define firewall rules for your managed devices.
Those rules can then be used in firewall rulesets to be deployed to the managed devices.
To create a firewall rule, proceed as follows:
1.
On the Firewall Rules tab, click New Rule.
The Create New Rule dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for the rule.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) to which the firewall ruleset is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this firewall rule. For information on how to define
OUs, please see chapter Management >
.
Group: The Group option is useful to group rules logically. With the drop-down list on top of the list you can filter the rules by their group. Grouping is only used for display purposes, it does not affect rule matching. To create a new group select the << New group
>> entry and enter a descriptive name in the Name field.
Source: The source network definition, describing from which host(s) or networks the packets are originating.
Service: The service definition that describes the protocol(s) and, in case of TCP or
UDP, the source and destination port(s) of the packets.
Destination: The destination network definition, describing the target host(s) or network(s) of the packets.
Action: The action that describes what to do with traffic that matches the rule. The following actions can be selected: l
Allow: The connection is allowed and traffic is forwarded.
l
Drop: Packets matching a rule with this action will be silently dropped.
l
Reject: Connection requests matching rules with this action will be actively rejected. The sender will be informed via an ICMP message.
SUM V4 Gateway Manager
87
7.5 Firewall
7 Configuration
Time period: By default, no time period definition is selected, meaning that the rule is always valid. If you select a time period definition, the rule will only be valid at the time specified by the time period definition. For more information, see Definitions >
Log traffic: If you select this option, logging is enabled and packets matching the rule are logged in the firewall log.
3.
Click Save.
The new rule appears on the firewall rules list.
To either edit or delete a firewall rule, click the corresponding buttons. You can also clone firewall rules, i.e. you create an identical object and edit this instead of creating a completely new definition.
Tip – If you want to delete several firewall rules at once, select the checkbox of the firewall rules in question, then, in the list header, click the arrow icon in the Action field and use the drop-down list at the left bottom of the page to activate the respective operation.
To deploy firewall rules, you need to define rulesets on the Firewall Rulesets tab.
7.5.2 Firewall Rulesets
On the Firewall > Firewall Rulesets tab you can create rulesets for the firewall rules defined on the Firewall Rules tab and deploy them to your managed devices. Additionally, you can turn firewall rulesets on and off.
Note – Only one firewall ruleset can be deployed per device.
To create a new ruleset, do the following:
1.
On the Firewall Rulesets tab, click New Ruleset.
The Create New Ruleset dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for the ruleset.
Comment (optional): Add a description or other information.
88
SUM V4 Gateway Manager
7 Configuration
7.5 Firewall
Org. Unit: Select the organizational unit (OU) to which the firewall ruleset is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this firewall rule. For information on how to define
OUs, please see chapter Management >
.
Position: Rulesets deployed by SUM always precede locally defined firewall rules on the
UTM.
Rules: Click the Folder icon to select firewall rules from the Firewall object list which overlays the menu. You need to turn on the firewall rules by clicking the toggle switch in front of a rule, if you want them to be active. If there is more than one rule, you can sort them by means of the blue arrows. Activated firewall rules are applied in the given order until the first rule matches.
3.
Click Save.
The new ruleset appears on the firewall rules list.
4.
Enable the firewall ruleset.
The new firewall ruleset is disabled by default (toggle switch is gray). Click the toggle switch.
The toggle switch turns green. The ruleset is now enabled.
Note – You need to enable the firewall ruleset if you want it to be active on the devices it is deployed to.
To either edit or delete a firewall ruleset, click the corresponding buttons. You can also clone firewall rulesets, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy button you can deploy a firewall ruleset to connected devices. If you want to undo the deploying, you can use the Remove button. To be able to delete a firewall ruleset, you first have to remove it from all devices it is deployed to.
Note that only one firewall ruleset can be deployed per device. Rulesets deployed to a device can easily be identified on the target device as the respective firewall rules are located above all other firewall rules and can neither be edited nor disabled or enabled on the device thus only having a View button.
SUM V4 Gateway Manager
89
7.6 Web Filtering
7 Configuration
7.6 Web Filtering
In the Configuration > Web Filtering section you can centrally define global objects for web filtering such as filter actions, URL filtering categories, exceptions, and PAC files to be used by your managed devices.
7.6.1 Filter Actions
On the Configuration > Web Filtering > Filter Actions tab you can centrally define filter actions to be used by your managed devices. An SUM filter action can even replace a local filter action of a managed device.
You can create a new filter action by clicking the New Filter Action button, or edit an existing filter action by clicking the corresponding Edit button. Either of these actions will launch the Filter
Action Wizard.
To either edit or delete a filter action, click the corresponding buttons. You can also clone filter actions, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy command you can deploy one or more filter actions to your devices. If you want to undo the deploying, you can use the Remove command. If you delete a filter action, it will simultaneously be deleted from the devices it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
Filter actions deployed to a device can easily be identified on the target device as they can neither be edited nor deleted on the device thus only having a View button.
Default: Click this button to replace the local default filter action defined on the Web Protection
> Web Filtering > URL Filtering tab with this global filter action on selected devices.
7.6.1.1 Filter Action Wizard
To launch the Filter Action Wizard click on the New Filter Action button. In the Wizard you have the following options.
Categories
Configure default settings for controlling access to certain kinds of websites.
Name: Enter a descriptive name for this filter action.
90
SUM V4 Gateway Manager
7 Configuration
7.6 Web Filtering
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) to which the filter action is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this filter action. For information on how to define OUs, please see chapter Man-
agement >
.
Allow/Block selection: Decide whether your selection of website categories should be allowed or blocked. The following options are available: l
Allow all content, except as specified below: Block only the categories you have selected.
l
Block all content, except as specified below: Block all categories except the ones you have selected.
The default option is Allow. The list of categories will indicate whether selected categories will be allowed or blocked. For cases where a website matches on more than one category, both must apply. For instance, if you allow Entertainment, but block Games, a site that is categorized as both would be allowed if the Allow button were selected and blocked if the Block button were selected.
Block spyware infection and communication: Selecting this option will detect and block spyware. This prevents computers on your network from becoming infected by new spyware.
Activating this feature will also detect and block traffic from installed spyware applications. Note that this option is only available if the first option on the page is set to Allow.
Category: Set website categories to Block, Allow, or Warn. Website categories and their associated subcategories can be configured on the Configuration > Web Filtering > URL Filtering
Categories tab. If you select the Warn action, users browsing to a site in that category will first be presented with a warning page, but they can proceed to the site if they choose.
Uncategorized websites: You can set the default behavior of uncategorized websites to
Block Warn or Allow.
Block websites with a reputation below a threshold of: Websites can be classified as either Trusted, Neutral, Unverified, Suspicious, or malicious, the latter not being listed. Unclassified websites are referred to as Unverified. You can select which reputation a website requires in order to be allowed access from your network. Websites below the selected threshold will be blocked. Note that this option is only available if the first option on the page is set to Allow. For more information on website reputations please refer to http://www.trustedsource.org
.
SUM V4 Gateway Manager
91
7.6 Web Filtering
7 Configuration
Click Next to proceed to the next configuration page, Save to save your configuration, or Cancel to discard all changes and close the configuration dialog.
Websites
Block these websites: If you want to block a specific URL or website, or a subset of webpages of a specific domain, regardless of its category, define it here. This has the effect that websites defined here can be blocked even if they belong to a category you want to allow.
1.
Click the Plus icon.
The insert field appears.
2.
Enter the website.
3.
Click Apply.
4.
Click Save.
Allow these websites: If you want to allow a specific URL or website, or a subset of webpages of a specific domain, regardless of its category, define it here. This has the effect that websites defined here can be allowed even if they belong to a category you want to block.
1.
Click the Plus icon.
The insert field appears.
2.
Click Apply.
3.
Click Save.
Downloads
Configure which file types and MIME types should be blocked.
Blocked File Extensions: Filter certain files from web traffic using file extensions in the
Blocked file extensions list. You can add additional file extensions or delete file extensions that are not to be blocked. To add a file extension, click the Plus icon in the Blocked file extensions box and enter the file extension you want to block, for example exe (without a leading dot).
Note – Files within archives (e.g. zip files) will not be scanned for blocked file types, blocked extensions or blocked MIME types. To protect your network from these within archived files, consider blocking archive file types such as zip, rar, etc.
Blocked MIME Types: Filter files from web traffic using MIME types listed in the Blocked
MIME types list. To add a MIME type, click the Plus icon in the Blocked MIME types box and enter the MIME type. You can use wildcards (*) in the Blocked MIME types list, such as audio/*
.
92
SUM V4 Gateway Manager
7 Configuration
7.6 Web Filtering
Block downloads larger than: Specify this option to prevent users from downloading files that exceed the specified size (in MB).
Click Next to proceed to the next configuration page, Save to save your configuration, or Cancel to discard all changes and close the configuration dialog.
Antivirus
Use Antivirus scanning: Select the option to have inbound and outbound web traffic scanned for viruses. Sophos UTM Manager features several antivirus settings: l
Single Scan: Default setting; provides maximum performance using the engine defined on the System Settings > Scan Settings tab of the gateway unit.
l
Dual Scan: Provides maximum recognition rate by scanning the respective traffic twice using different virus scanners. Note that dual scan is not available with BasicGuard subscription.
l
Block potentially unwanted applications (PUAs): PUAs are programs that are not malicious, but may be unsuitable for a business environment. This feature is only available when using the Sophos anti-virus engine.
Do not scan files larger than: Specify the maximum size of files to be scanned by the antivirus engine(s). Files exceeding this size will be exempt from scanning.
Tip – If you want to prevent files larger than the maximum scanning size from being downloaded, set the Block downloads larger than value on the Downloads page.
Active Content Removal
In the Active Content Removal area you can configure the automatic removal of specific web content such as embedded objects in webpages. You can configure the following settings: l
Disable JavaScript: This feature will disable all <SCRIPT> tags in HTML pages, resulting in the deactivation of functions that are embedded in or included from HTML pages.
l
Remove embedded objects (ActiveX/Java/Flash): This feature will remove all
<OBJECT> tags from HTML pages, stripping off dynamic content including ActiveX, Flash, or Java from incoming HTTP traffic.
Click Next to proceed to the next configuration page, Save to save your configuration, or Cancel to discard all changes and close the configuration dialog.
SUM V4 Gateway Manager
93
7.6 Web Filtering
7 Configuration
Additional Options
Enforce Website Protection Features
SafeSearch: Certain search providers have a SafeSearch feature that is designed to remove adult content from search results. You can enforce the use of SafeSearch for Google, Bing or
Yahoo. When enabled, a provider's SafeSearch will be enforced, and cannot be turned off or bypassed by Web Filter users. To configure this feature, select the provider whose SafeSearch you want to enforce.
YouTube for Schools: If enabled, users trying to open a YouTube video are restricted to
YouTube videos either belonging to the sub-section YouTube EDU or uploaded by your school account. To make this work, you have to sign up at the YouTube for Schools program to get a
School ID which you need to enter below.
Note – On the Sophos UTM Manager, you have to make sure that the top-level domains youtube.com
and ytimg.com as well as videos in general are not blocked. If you have enabled YouTube for Schools, you need to enter the School ID or code supplied by YouTube.
Enforce allowed domains for Google Apps: Google Apps can block users from accessing certain services unless their Google account is a member of the Google Apps domain. Turning this on enforces this feature, and cannot be turned off or bypassed by Web Filter users. To configure this feature, select Enforce allowed domains for Google Apps. Then, at the top of the
Domains box, click the Plus icon or the Action icon to add or import Google Apps domains.
Activity Logging
You can select which activities will be logged: l
Log accessed pages: This feature will log information about all pages that have been accessed through the UTM.
l
Log blocked pages: This feature will log information about pages that have been blocked from being accessed.
Click Save to save your configuration, or Cancel to discard all changes and close the configuration dialog.
94
SUM V4 Gateway Manager
7 Configuration
7.6 Web Filtering
7.6.2 URL Filtering Categories
On the Configuration > Web Filtering > URL Filtering Categories tab you can centrally define filter categories to be used by your managed devices. An SUM filter category can even replace a local filter category of a managed device.
To create a URL filtering category, proceed as follows:
1.
On the URL Filtering Categories tab, click New Filter Category.
The Create New Filter Category dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for the filter category.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) to which the filter category is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this filter category. For information on how to define
OUs, please see chapter Management >
.
3.
Select the categories.
Select the checkboxes of the categories you want to add to the filter category.
4.
Click Save.
The filter category will be added to the URL Filtering Categories list.
To either edit or delete a filter category, click the corresponding buttons. You can also clone filter categories, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy command you can deploy one or more filter categories to your devices. If you want to undo the deploying, you can use the Remove command. If you delete a filter category, it will simultaneously be deleted from the devices it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
Filter categories deployed to a device can easily be identified on the target device as they can neither be edited nor deleted on the device thus only having a View button.
SUM V4 Gateway Manager
95
7.6 Web Filtering
7 Configuration
7.6.3 Exceptions
On the Configuration > Web Filtering > Exceptions tab you can centrally define exceptions to be used by your managed devices. An SUM exception list can even replace a local exception list of a managed device.
To create an exception list, proceed as follows:
1.
On the Exceptions tab, click New Exception List.
The Create Exception List dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for the exception list.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) to which the exception list is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this exception list. For information on how to define OUs, please see chapter Management >
Skip These Checks: Select the security checks that should be skipped: l
Authentication: If the Web Filter runs in Authentication mode, you can skip authentication for the source hosts/networks or target domains.
l
Caching: Select to disable caching for specific domains or source hosts/networks.
l
Antivirus: Select to disable virus scanning, which checks messages for unwanted content such as viruses, trojan horses and the like.
l
Extension blocking: Select to disable the file extension filter, which can be used to block content that contains certain types of files based on their extensions.
l
MIME type blocking: Select to disable the MIME type filter, which can be used to block content that has a certain MIME type.
l
URL filter: Select to disable the URL filter, which controls the access to certain kinds of websites.
l
Content removal: Select to bypass the removal of special content in webpages such as embedded objects (e.g., multimedia files) or JavaScript.
l
SSL scanning: Select to skip SSL scanning for the webpage in request. This is useful with online banking websites or with websites that do not play well with SSL
96
SUM V4 Gateway Manager
7 Configuration
7.6 Web Filtering interception. Note that for technical reasons this option does not work for any transparent Web Filter mode. With transparent mode, use the Transparent Mode
Skiplist instead (see Web Protection > Filtering Options > Misc tab in SUM). In standard mode, exceptions can only be made based on the destination host or IP address depending on what the client sends. With exceptions based on categories, instead of the whole URL, only the hostname will be classified.
l
Certificate trust check: Select to skip the trust check of the HTTPS server certificate. Note that, when the Web Filter works in transparent mode with authentication, skipping the certificate trust check based on a users/groups match (For all
requests Coming from these users/groups) is technically impossible.
l
Certificate date check: Select to skip the check of whether the HTTPS certificate's date is valid.
The following two options are useful if there are persons or members of e.g. a works council whose activities must not be logged at all: l
Accessed pages: Select to not log pages that have been accessed. Those page requests will also be excluded from reporting.
l
Blocked pages: Select to not log pages that have been blocked. Those page requests will also be excluded from reporting.
For all requests: Select at least one condition for which the security checks are to be skipped. You can logically combine several conditions by selecting either And or Or from the drop-down list in front of a condition. The following conditions can be set: l
Coming from these source networks: Select to add source hosts/networks that should be exempt from the security checks of this exception rule. Enter the respective hosts or networks in the Hosts/Networks box that opens after selecting the condition.
l
Going to these domains: Select to add target domains that should be exempt from the security checks of this exception rule. Add the respective domains to the
Target Domains box that opens after selecting the condition. Regular expressions are allowed here. Example: ^https?://[^.]*\.domain.com matches HTTP
(S) connections to all subdomains of the domain.
Cross Reference – For detailed information on using regular expressions for web filtering, see the Sophos Knowledgebase .
SUM V4 Gateway Manager
97
7.6 Web Filtering
7 Configuration
Note – When using Transparent mode with SSL scanning enabled, you need to enter the target domain(s) as IP addresses. Otherwise the exception will fail for technical reasons.
l
Going to these categories of websites: Select to skip security checks for certain categories. Select then the categories from the list that opens after selecting the condition.
3.
Click Save.
The new exception appears on the Exceptions list.
4.
Enable the exception.
The new exception is disabled by default (toggle switch is gray). Click the toggle switch to enable the exception.
The exception is now enabled (toggle switch is green).
Note – You need to enable an exception if you want it to be active on the devices it is deployed to.
To either edit or delete an exception, click the corresponding buttons. You can also clone exception lists, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy command you can deploy one or more exception lists to your devices. If you want to undo the deploying, you can use the Remove command. If you delete an exception list, it will simultaneously be deleted from the devices it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
Exception lists deployed to a device can easily be identified on the target device as they can neither be edited nor deleted on the device thus only having a View button.
7.6.4 PAC File
The proxy auto configuration is a feature that enables you to centrally provide a proxy auto configuration file (PAC file) which can be fetched by browsers. The browsers will in turn configure their proxy settings according to the details outlined in the PAC file.
98
SUM V4 Gateway Manager
7 Configuration
7.6 Web Filtering
The PAC file is named wpad.dat, has the MIME type application/x-ns-proxyautoconfig and will be provided by the UTM. It contains the information you enter into the text box, for example: function FindProxyForURL(url, host)
{ return "PROXY proxy.example.com:8080; DIRECT"; }
The function above instructs the browser to redirect all page requests to the proxy of the server proxy.example.com
on port 8080. If the proxy is not reachable, a direct connection to the Internet will be established.
The hostname can also be written as a variable called ${asg_hostname}. This is especially useful when you want to deploy the same PAC file to several Sophos UTM appliances using
Sophos UTM Manager. The variable will then be instantiated with the hostname of the respective UTM. Using the variable in the example above would look like the following: function FindProxyForURL(url, host)
{ return "PROXY ${asg_hostname}:8080; DIRECT"; }
To create a PAC file, proceed as follows:
1.
On the PAC File tab, click New PAC File.
The Create New PAC File dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for the PAC file.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) to which the PAC File is to be assigned to.
If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this PAC file. For information on how to define OUs, please see chapter Management >
.
Configuration: Enter the configuration information into the text box (see example above).
3.
Click Save.
The new PAC file is added to the PAC File list.
4.
Enable the PAC file.
The new PAC file is disabled by default (toggle switch is gray). Click the toggle switch.
The toggle switch turns green. The PAC file is now enabled.
SUM V4 Gateway Manager
99
7.7 VPN
7 Configuration
To either edit or delete a PAC file, click the corresponding buttons. You can also clone PAC files, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy button you can deploy the respective PAC file to connected devices. If you want to undo the deploying, you can use the Remove button. To be able to delete a PAC file, you first have to remove it from all devices it is deployed to.
Note that only one PAC file can be deployed per device. The Proxy Auto Configuration section on the Web Protection > Web Filtering > Advanced tab of the respective device cannot be edited locally.
7.7 VPN
The VPN section allows you to create VPN tunnels, modify them, and to manage IPsec policies.
7.7.1 VPN Configuration
On the VPN > VPN Configuration tab you can create and manage IPsec VPN tunnels. For existing VPN tunnels, the tab provides you with abstract information on each virtual private network which has been configured with SUM.
The following operations are possible if one or more entries have been selected: l
Disable: Sets administrative shutdown status for the VPN without deleting the configuration.
l
Enable: Re-activates a previously shutdown VPN.
l
Delete: Completely remove the configuration aspects of this VPN from the affected devices and tear down the connection.
The following operations are possible if exactly one entry has been selected: l
Modify: Allows to change parameters within an existing VPN.
l
Details: Drill-down functionality to see specific details for this VPN.
The following operations are possible only if no entry has been selected: l
Create: Allows to create a new VPN from scratch.
l
Level: Shows the overall health status of the VPN, e.g. whether all tunnels are established.
l
Name: The name given to this VPN during its creation or modification.
100
SUM V4 Gateway Manager
7 Configuration
7.7 VPN l
Policy: The security policy used within this VPN.
l
Type: The topology type of this particular VPN, e.g. Site2Site.
l
Auth: The authentication method employed, e.g. RSA based.
l
Options: Whether any options as Automatic firewall rules or Strict routing have been activated.
l
Tunnels: The number of established vs. defined tunnels within this VPN.
l
Rollout: The deployment status of the configuration to the devices involved, showing completed vs. work in progress l
Active: Shows whether this VPN has been administratively disabled or enabled.
Tip – You can sort all elements by clicking the table column headings. Double-clicking into a row of the table opens the Configuration VPN Details page for this particular entry.
7.7.2 Configuration Wizard
You can invoke the VPN wizard by either pressing the Create or the Modify button on the VPN
Configuration tab. The latter allows you to change settings of an already existing setup and requires the selection of exactly one row entry.
The VPN wizard may differ in the number of configuration steps depending on the topology type of the VPN to be configured.
To create an IPsec Site-to-site VPN do the following:
1.
On the control panel click Create.
The button is only active if no table row is selected. Select one of the pre-defined topology types. Currently Site-to-site is offered to quickly interconnect networks with each other.
A wizard is opened displaying a welcome page.
2.
Click Next to start the configuration.
The Choose Participating Devices step is displayed.
Note – The wizard contains an inline help which is located on the right margin. Click on the margin to get the context-sensitive information.
3.
Choose participating devices.
Click the Folder icon and select two devices that are to be part of the VPN.
SUM V4 Gateway Manager
101
7.7 VPN
7 Configuration
4.
Click Next.
The Device Configuration (1 of 2) step is displayed.
5.
Make the following settings for the first participating device:
l
Tunnel Interface: Select the terminating interface for the VPN on the first device.
One of the interfaces in a site-to-site VPN can be fully-dynamic, the other interface on the peer device must be a static one. The data from this interface will be used to create a remote host object for the respective peer device in the VPN. If the interface configuration of a tunnel interface is changed locally in the WebAdmin of one device, Sophos UTM Manager will be aware of such a change and propagate it to the peer device in the VPN. The peer device will then adjust its tunnel configurations accordingly. There is no need to manually reconfigure your VPNs, and downtime during the automatic adjustment phase will be very minimal.
l
Connection Mode: Set the mode to Respond Only if the peer device in the VPN is configured to have a dynamic tunnel interface. If the address of the remote host is static, please select Initiate Connection instead.
Tip – If you have a typical branch office scenario with a dynamic Internet connection select Respond Only for the headquarter’s gateway and Initiate Con-
nection for the branch office. For static scenarios select Initiate Connection on both gateways.
l
Local Networks: Select all interface-attached networks which should be reachable on this side of the VPN. The networks will be exported as SUM-specific objects to the remote gateway and act as Remote Networks in the respective tunnel configurations of the peer device. If the network interfaces from which the
Local/Remote Networks originate are changed locally within the WebAdmin of a device, SUM will be aware of these changes and will transparently adjust the configuration aspects of the peer device.
l
Networks: Select the networks created by SUM that should be reachable on this side of the VPN. You need to create such networks on the Configuration > Defin-
itions > Networks tab before you can use them here.
l
Support Path MTU Discovery: PMTU (Path Maximum Transmission Unit) refers to the size of data packets transmitted. It is usually preferable that IP data packets be of the largest size that does not require fragmentation anywhere along the path from the source to the destination. If any of the data packets are too large to be forwarded without fragmentation by some router along the path, that router will discard them and return ICMP Destination Unreachable messages with a code
102
SUM V4 Gateway Manager
7 Configuration
7.7 VPN meaning 'fragmentation needed and DF set'. Upon receipt of such a message, the source host reduces its assumed PMTU for the path. If you enable this option,
Gateway Manager enables PMTU if it is enabled on the server side.
l
Support Congestion Signaling (ECN): ECN (Explicit Congestion Notification) is an extension to the Internet Protocol and allows end-to-end notifications of network congestion without dropping packets. Select this option if you want to copy
ECN information from the original IP packet header into the IPsec packet header.
Note that the remote endpoint must support it as well as the underlying network and involved routers.
l
Enable XAUTH Client Mode: XAUTH is an extension of IPsec IKE to authenticate users via username and password at a VPN gateway. To use XAUTH for authentication with this remote gateway, select the option.
6.
Click Next.
The Device Configuration (2 of 2) step is displayed.
7.
Make the following settings for the second participating device:
l
Tunnel Interface: Select the terminating interface for the VPN on the second device. Otherwise, configuration is the same as for the first device. Also, change propagation is handled exactly the same way.
l
Connection Mode: Set the mode to Respond Only if the peer device in the VPN is configured to have a dynamic tunnel interface. If the address of the remote host is static, please select Initiate Connection instead. If the first device was already configured to Respond Only it is only possible to choose Initiate Connection for the second device.
l
Local Networks: Please choose all networks (currently limited to interface attached networks) which should be reachable on this side of the VPN. Otherwise, configuration is the same as for the first device. Also, change propagation is handled exactly the same way.
Note – Every local network from one gateway will be connected to all local networks configured for the other gateway resulting in a corresponding number of
IPsec tunnels making up this VPN.
l
Networks: Select the networks created by SUM that should be reachable on this side of the VPN. You need to create such networks on the Configuration > Defin-
itions > Networks tab before you can use them here.
SUM V4 Gateway Manager
103
7.7 VPN
7 Configuration
l
Support Path MTU Discovery: PMTU (Path Maximum Transmission Unit) refers to the size of data packets transmitted. It is usually preferable that IP data packets be of the largest size that does not require fragmentation anywhere along the path from the source to the destination. If any of the data packets are too large to be forwarded without fragmentation by some router along the path, that router will discard them and return ICMP Destination Unreachable messages with a code meaning 'fragmentation needed and DF set'. Upon receipt of such a message, the source host reduces its assumed PMTU for the path. If you enable this option,
SUM enables PMTU if it is enabled on the server side.
l
Support Congestion Signaling (ECN): ECN (Explicit Congestion Notification) is an extension to the Internet Protocol and allows end-to-end notifications of network congestion without dropping packets. Select this option if you want to copy
ECN information from the original IP packet header into the IPsec packet header.
Note that the remote endpoint must support it as well as the underlying network and involved routers.
l
Enable XAUTH Client Mode: XAUTH is an extension of IPsec IKE to authenticate users via username and password at a VPN gateway. To use XAUTH for authentication with this remote gateway, select the option. To enable XAUTH for authentication with this remote gateway, select the option and provide username and password (twice) as required by the remote gateway.
8.
Click Next.
The General VPN Settings step is displayed.
9.
Make the following settings:
l
Name: Define a name for the VPN.
l
Policy: Select a security policy to use for this VPN. In addition to pre-defined policies you can create individual IPsec policies on the Configuration > VPN > IPsec
Policies tab.
l
Authentication: Select one of the offered authentication methods. Currently
RSA-based authentication is offered which is very easy to set-up but provides high-security nevertheless.
l
Comment (optional): Add a description or other information.
l
Auto firewall rule: Select this option to automatically create full-access rules within the established VPN boundaries. Please note, this will allow traffic in both directions.
104
SUM V4 Gateway Manager
7 Configuration
7.7 VPN
If you unselect the option, make sure that the appropriate rules are available on the gateways—either by deploying them via SUM or by creating them locally.
l
Strict routing: Select this option to ensure that VPN routing is done according to source and destination IP address (instead of only destination IP address). In this case, only those packets exactly matching the VPN tunnel definition are routed into the VPN tunnel.
l
Bind tunnel to local interface: By default, the option is unselected and all traffic originating from the selected local networks and going to the defined remote networks will always be sent through the tunnel. It is not possible to have multiple identical tunnels on different interfaces because the selector would always be the same. However, if enabled, the defined selector will be bound to the selected local interface.
10.
Click Next.
The Summary page is displayed. Read the summary page carefully and click Next to deploy your settings. Click Back to change your configuration or Cancel to exit the wizard without deploying the VPN.
11.
Click Finish.
The wizard closes and the VPN tunnel is being established.
7.7.3 VPN Details
The VPN Details page contains detailed information about the VPN in question.
The page is subdivided into the following sections: l
VPN Information: This section contains overall information for the VPN, e.g. topology type and the policy and authentication method used.
l
Tunnels: This section shows the status of all device pairs and their networks which are interconnected to implement the respective VPN topology desired, e.g. site-to-site.
l
Devices: This section contains the device specific information relating to the VPN in question. It shows the deployment status of the configuration as well as the actual status of all tunnels which have been established on this particular device.
Tip – With the Back button you can return to the previous page. For more information on how to use the controls please see chapter Navigation >
Page Actions and Control Panels
SUM V4 Gateway Manager
105
7.7 VPN
7 Configuration
7.7.4 IPsec Policies
To create an IPsec policy, proceed as follows:.
1.
On the IPsec Policies tab, click Create New IPsec Policy Definition.
The Create New IPsec Policy Definition dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for this policy.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) the IPsec policy is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this IPsec policy. For information on how to define OUs, please see chapter Management >
.
IKE encryption algorithm: The encryption algorithm specifies the algorithm used for encrypting the IKE messages. Supported algorithms are: l
DES (56 bit) l
3DES (168 bit) l
AES 128 (128 bit) l
AES 192 (192 bit) l
AES 256 (256 bit) l
Blowfish (128 bit) l
Twofish (128 bit) l
Serpent (128 bit)
Security Note – We strongly recommend against using DES, as it is a weak algorithm, and therefore represents a potential vulnerability.
IKE authentication algorithm: The authentication algorithm specifies the algorithm used for integrity checking of the IKE messages. Supported algorithms are: l
MD5 (128 bit) l
SHA (160 bit)
106
SUM V4 Gateway Manager
7 Configuration
7.7 VPN l
SHA 256 (256 bit) l
SHA 512 (512 bit)
IKE SA lifetime: This value specifies the timeframe in seconds for which the IKE SA
(security association) is valid and when the next rekeying should take place. Valid values are between 60 sec and 28800 sec (8 hrs). The default value is 7800 seconds.
IKE DH group: When negotiating a connection, the communicating parties also settle the actual keys used to encrypt the data. In order to generate a session key, IKE uses the
Diffie-Hellman (DH) algorithm, which utilizes random data. The random data generation is based on pool bits. The IKE group basically tells the number of pool bits. The more pool bits, the larger the random numbers. The larger the numbers, the harder it is to crack the
Diffie-Hellman algorithm. As a consequence, more pool bits mean more security but also the consumption of more CPU resources. Currently, the following Diffie-Hellman groups are supported: l
Group 1: MODP 768
l
Group 2: MODP 1024
l
Group 5: MODP 1536
l
Group 14: MODP 2048
l
Group 15: MODP 3072
l
Group 16: MODP 4096
Security Note – Group 1 (MODP 768) is considered weak and only supported for interoperability reasons. We strongly recommend against using it, as it represents a potential vulnerability.
IPsec encryption algorithm: The same encryption algorithms as for IKE. Additionally there is the following entry: l
No encryption (null)
Security Note – We strongly recommend against using no encryption or DES, as this represents a potential vulnerability.
IPsec authentication algorithm: The same authentication algorithms as for IKE.
SUM V4 Gateway Manager
107
7.7 VPN
7 Configuration
Those are available for compliance with tunnel endpoints not adhering to RFC 4868 , for example SUM (i.e., ASG) versions older than V8, and therefore do not support truncated checksums longer than 96 bit.
IPsec SA lifetime: This value specifies the timeframe in seconds for which the IPsec SA is valid and when the next rekeying should take place. Valid values are between 60 sec and 86400 sec (1 day). The default value is 3600 seconds.
IPsec PFS group: Perfect Forward Secrecy (PFS) refers to the notion that if a session key is compromised, it will permit access only to data of this specific session. In order for
PFS to exist, the key used to protect the IPsec SA must not be derived from random keying material used to get the keys for the IKE SA. Therefore, PFS initiates a second Diffie-
Hellman key exchange proposing the selected DH group for the IPsec connection to get a new randomly generated key. Supported Diffie-Hellman groups are the same as for
IKE.
Enabling PFS is considered to be more secure, but it takes also more time for the exchange. It is not recommended to use PFS on slow hardware.
Note – PFS is not fully interoperable with all vendors. If you notice problems during the negotiation, you might consider disabling PFS.
Strict policy: If an IPsec gateway makes a proposition with respect to an encryption algorithm and to the strength, it might happen that the gateway of the receiver accepts this proposition, even though the IPsec policy does not correspond to it. If you select this option and the remote endpoint does not agree on using exactly the parameters you specified, the IPsec connection will not be established. Suppose the IPsec policy of your SUM requires AES-256 encryption, whereas, for example, a road warrior with SSH Sentinel wants to connect with AES-128; with the strict policy option enabled, the connection would be rejected.
Note – The compression setting will not be enforced via Strict policy.
Compression: This option specifies whether IP packets should be compressed by means of the IP Payload Compression Protocol (IPComp) prior to encryption. IPComp reduces the size of IP packets by compressing them to increase the overall communication performance between a pair of communicating hosts or gateways. Compression is turned off by default.
108
SUM V4 Gateway Manager
7 Configuration
7.8 Endpoint Protection
3.
Click Save.
The new policy appears on the IPsec Policies list.
To either edit or delete an IPsec policy, click the corresponding buttons. You can also clone
IPsec policies, i.e. you create an identical object and edit this instead of creating a completely new definition.
With the Deploy command you can deploy one or more IPsec policies to your devices. If you want to undo the deploying, you can use the Remove command. If you delete an IPsec policy, it will simultaneously be deleted from the devices it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
IPsec policies deployed to a device can easily be identified on the target device as they can neither be edited nor deleted on the device thus only having a View button.
7.8 Endpoint Protection
On the Endpoint Protection pages you can centrally manage global objects for endpoint protection to be used by your managed gateways, such as different sets of antivirus and device control settings.
7.8.1 Antivirus Policies
On the Configuration > Endpoint Protection > Antivirus Policies tab you can manage different sets of antivirus settings which can be subsequently deployed to the managed gateways.
To add a new antivirus policy, proceed as follows:
1.
Click the New Antivirus Policy button.
The Create Antivirus Policy dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for this policy.
Comment (optional): Add a description or other information.
Org. Unit: Select the organizational unit (OU) the antivirus policy is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this antivirus policy. For information on how to define OUs, please see chapter Management >
SUM V4 Gateway Manager
109
7.8 Endpoint Protection
7 Configuration
On-access scanning: If enabled, whenever you copy, move, or open a file, the file will be scanned and access will only be granted if it does not pose a threat to your computer or has been authorized for use.
l
Scan for PUA: If enabled, the on-access scanning will include a check for potentially unwanted applications (PUAs).
Automatic cleanup: If enabled, items that contain viruses or spyware will automatically be cleaned up, any items that are purely malware will be deleted, and any items that have been infected will be disinfected. These disinfected files should be considered permanently damaged, as the virus scanner cannot know what the file contained before it was damaged.
Sophos live protection: If the antivirus scan on an endpoint computer has identified a file as suspicious, but cannot further identify it as either clean or malicious based on the
Sophos threat identity (IDE) files stored on the computer, certain file data (such as its checksum and other attributes) is sent to Sophos to assist with further analysis.
The in-the-cloud checking performs an instant lookup of a suspicious file in the
SophosLabs database. If the file is identified as clean or malicious, the decision is sent back to the computer and the status of the file is automatically updated.
l
Send sample file: If a file is considered suspicious, but cannot be positively identified as malicious based on the file data alone, you can allow Sophos to request a sample of the file. If this option is enabled, and Sophos does not already hold a sample of the file, the file will be submitted automatically. Submitting sample files helps Sophos to continuously enhance detection of malware without the risk of false positives.
Suspicious behavior (HIPS): If enabled, all system processes are watched for signs of active malware, such as suspicious writes to the registry, file copy actions, or buffer overflow techniques. Suspicious processes will be blocked.
Web protection: If enabled, the website URLs are looked up in the Sophos online database of infected websites.
l
Block malicious sites: If enabled, sites with malicious contents will be blocked.
l
Download scanning: If enabled, during a download data will be scanned by antivirus scanning and blocked if the download contains malicious content.
Scheduled scanning: If enabled, a scan will be executed at a specified time.
110
SUM V4 Gateway Manager
7 Configuration
7.8 Endpoint Protection l
Rootkit scan: If enabled, with each scheduled scan the computer will be scanned for rootkits.
l
Time period: Select a time period when the scans will take place, taking the time zone of the endpoint into account.
3.
Click Save.
The new policy appears on the Antivirus Policies list.
To either edit or delete a policy, click the corresponding buttons.
With the Deploy command you can deploy one or more antivirus policies to your gateways. If you want to undo the deploying, you can use the Remove command. If you delete an antivirus policy, it will simultaneously be deleted from the gateways it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
Antivirus policies deployed to a gateway can easily be identified on the target device as they can neither be edited nor deleted.
7.8.2 Device Control Policies
On the Configuration > Endpoint Protection > Device Control Policies tab you can manage different sets of device control settings which can be subsequently deployed to the connected gateways. These sets are called device control policies. Device control policies are used to define which types of devices are allowed for certain endpoints (computer groups).
To add a new device control policy, proceed as follows:
1.
Click the New Device Control Policy button.
The Create New Device Control Policy dialog box opens.
2.
Make the following settings:
Name: Enter a descriptive name for this policy.
Comment (optional): Add a description or other information.
Org. unit: Select the organizational unit (OU) the device control policy is to be assigned to. If you have no OU(s) defined yet, only Global is available. Note that the OU cannot be changed afterwards for this device control policy. For information on how to define OUs, please see chapter Management >
Storage Devices: For different types of storage devices you can configure whether they should be Allowed or Blocked. Where applicable, a Read only entry is available, too.
SUM V4 Gateway Manager
111
7.9 UTM Notifications
7 Configuration
Network Devices: For modems and wireless networks you can configure whether they should be Allowed, Block bridged, or Blocked.
Short Range Devices: For Bluetooth and infrared devices you can configure whether they should be Allowed or Blocked.
3.
Click Save.
The new policy appears on the Device Control Policies list.
To either edit or delete a policy, click the corresponding buttons.
With the Deploy command you can deploy one or more device control policies to your connected gateways. If you want to undo the deploying, you can use the Remove command. If you delete a device control policy, it will simultaneously be deleted from the gateways it is deployed to, if it is not in use. If it is used, it will be transformed into a local object.
Device control policies deployed to a gateway can easily be identified on the target gateway as they can neither be edited nor deleted.
7.9 UTM Notifications
On the UTM Notifications pages you can configure notification recipients of gateways and change the notification types of your UTMs. You can decide if you want to replace the existing recipients lists or if you just want to add notification recipients. You are also able to change notification types of selected gateways.
7.9.1 Notification Recipients
On the Configuration > UTM Notifications > Recipients tab you can modify the notification recipients of selected gateways. You can decide between adding recipients to the existing recipients on your UTMs and replacing existing recipients on your UTMs with the list you created.
To add or edit notification recipients of your UTMs, proceed as follows:
1.
Select a gateway.
Select the gateway(s) for which you want to configure the recipients.
2.
Add a recipient.
Click on the green plus icon and enter the recipients email address.
112
SUM V4 Gateway Manager
7 Configuration
7.9 UTM Notifications
3.
Decide if you want to add or replace recipients.
Select whether you want to Add Recipients to the existing list on your UTMs or to Replace
Recipients on your UTMs with your new recipients.
4.
Click Apply.
Your settings will be saved.
The lists on your connected UTMs will be replaced/extended with the recipients you added in the field Notification Recipients.
7.9.2 Notification Types
On the Configuration > UTM Notifications > Types tab you can modify the notification types of selected gateways.
To change notification types of your UTMs, proceed as follows:
1.
Select a gateway.
Select the gateway(s) for which you want to configure the notification types.
2.
Select the notification type.
Open the drop down menu of the requested notification type.
3.
Activate the notification(s).
Activate the checkmark(s) for SNMP and/or Email next to the requested notification and activate Set to confirm.
4.
Click Apply.
Your settings will be saved.
The notifications will be changed on your connected UTMs.
SUM V4 Gateway Manager
113
8 Reporting
The reporting function of Sophos UTM Manager provides real-time information of its managed devices by collecting current log data and presenting it in a graphical format.
Note – The reporting function of SUM is not supported by devices which have a version installed older than 7.501. For that reason, those devices are not displayed in the reporting pages of SUM. In addition, reporting data from devices is not part of a SUM backup. Instead, after restoring a backup, reporting data will be fetched anew from the connected devices.
The following topics are included in this chapter: l
l
l
l
Zoom View
Clicking one of the graphs opens a zoom view, i.e. a larger view of the selected graph. Zoom view is available for the graphs on the tabs of Hardware, Network, and Protection. When you hover with the mouse on the zoom view, there appear the following navigation icons: l
Horizontal arrows: Switch between the different network interfaces.
l
Vertical arrows: Switch between the different devices.
l
Daily/Weekly/Monthly/Yearly tabs: Change the view to the daily, weekly, monthly, or yearly time frame.
8.1 Hardware
The Reporting > Hardware tabs display hardware information of managed devices for the time frames daily, weekly, monthly, and yearly—which reflects the division you are used to from the reporting section of the devices themselves.
8.1 Hardware
8 Reporting
8.1.1 Daily
The Hardware > Daily tab provides overview statistics about the following hardware components of the last 24 hours: l
CPU Usage l
RAM Usage l
Disk Usage
You can change the information displayed to be more selective by means of the Filter Bar, which is the first row below the table header: l
Device Name: You can type (a part of) the device name into this filter field to restrict the displayed devices to those whose name correspond.
l
CPU Usage: You can restrict the displayed devices to those which are above a certain percentage threshold.
l
RAM Usage: You can restrict the displayed devices to those which are above a certain percentage threshold, either in their Average Memory Usage or Average Swap Usage.
l
Disk Usage: You can restrict the displayed devices to those which are above a certain percentage threshold, either in their Average Log Usage or Average Root Usage.
8.1.2 Weekly
The Hardware > Weekly tab provides overview statistics about selected hardware components for the last seven days. The histograms are described in the
section.
8.1.3 Monthly
The Hardware > Monthly tab provides overview statistics about selected hardware components for the last four weeks. The histograms are described in the
section.
8.1.4 Yearly
The Hardware > Yearly tab provides overview statistics about selected hardware components for the last twelve months. The histograms are described in the
section.
116
SUM V4 Gateway Manager
8 Reporting
8.2 Network
8.2 Network
The Reporting > Network tabs display network information of managed devices for the time frames daily, weekly, monthly, and yearly—which reflects the division you are used to from the reporting section of the devices themselves.
8.2.1 Daily
The Network > Daily tab provides overview statistics about the following network components of the last 24 hours: l
Br: Configured bridges l
Eth: Configured Ethernet interfaces
The network components are consecutively numbered. Unconfigured or nonexistent network interfaces are being reflected by an empty cell in the respective table column.
You can change the information displayed to be more selective by means of the Filter Bar, which is the first row below the table header: l
Device Name: You can type (a part of) the device name into this filter field to restrict the displayed devices to those whose name correspond.
l
Br/Eth: You can restrict the displayed devices to those which are above a certain traffic threshold.
8.2.2 Weekly
The Network > Weekly tab provides overview statistics about selected network components for the last seven days. For more information, see
8.2.3 Monthly
The Network > Monthly tab provides overview statistics about selected network components for the last four weeks. For more information, see
SUM V4 Gateway Manager
117
8.3 Protection
8 Reporting
8.2.4 Yearly
The Network > Yearly tab provides overview statistics about the traffic passing each configured interface of the last twelve months. For more information, see
.
8.3 Protection
The Reporting > Protection tabs display network protection information of managed devices for the time frames daily, weekly, monthly, and yearly—which reflects the division you are used to from the reporting section of the devices themselves.
8.3.1 Daily
The Protection > Daily tab provides overview statistics about the following network protection components of the last 24 hours: l
Firewall l
IPS (Intrusion Prevention) l
Web Protection l
Email Protection
You can change the information displayed to be more selective by means of the Filter Bar, which is the first row below the table header: l
Device Name: You can type (a part of) the device name into this filter field to restrict the displayed devices to those whose name correspond.
l
Firewall: You can restrict the displayed devices to those which exceed a certain threshold, either of the Average Firewall Violation or the Average Firewall Portscan.
l
IPS: You can restrict the displayed devices to those which exceed a certain threshold, either of the Average Alert Events or the Average Drop Events.
l
Web Protection: You can restrict the displayed devices to those which exceed a certain threshold, either of the Average Blocked (pages) or the Requests Total.
l
Email Protection: You can restrict the displayed devices to those which exceed a certain threshold, either of the Average Blocked (emails) or the Mails Total.
118
SUM V4 Gateway Manager
8 Reporting
8.4 On Demand
8.3.2 Weekly
The Protection > Weekly tab provides overview statistics about selected network protection components for the last seven days. For more information, see
8.3.3 Monthly
The Protection > Monthly tab provides overview statistics about selected network protection components for the last four weeks. For more information, see
8.3.4 Yearly
The Protection > Yearly tab provides overview statistics about selected network protection components for the last twelve months. For more information, see
.
8.4 On Demand
The tabs of the Reporting > On Demand menu let you generate on-demand reports for accounting, network protection, web protection, and mail protection. The Report Overview page keeps all reports created during the current session and all reports that have been saved explicitly.
Icons in On-Demand Reporting
Save: Click to save the current report. Optionally, you can enter a description.
Calendar: Opens a small calendar to select a date.
Print: Opens a print preview of the report. From there, you can initiate printing.
Legend of Counting Units
Throughout the reporting pages, vast numbers may occur such as the number of firewall events or processed emails. For better readability, large numbers are abbreviated as follows
("SI prefix"):
SUM V4 Gateway Manager
119
8.4 On Demand
8 Reporting
l
K: Thousand, e.g. 1.6 K means 1,600.
l
M: Million, e.g. 1.6 M means 1,600,000.
8.4.1 Generating Reports
The generation of reports is similar with all sections of on-demand reporting. Differences are discussed in the sections of the respective tab.
To create a report, do the following:
1.
Select a device.
Click the Folder icon of the Devices box to select one or more devices which are to be part of the report.
The object list Devices opens of the left side of Gateway Manager.
If you select the Any device, all devices that support that kind of report are implicitly included in the report.
2.
Select a time frame.
From the drop-down list Time Frame select a time frame for the report. The following time frames are predefined l
Today
l
Yesterday
l
Last 7 Days
l
Last 30 Days
l
Custom: If you select Custom, you need to select a start date and an end date for the report. For that, click on the Calendar icon of the From box and of the To box.
In each case a small calendar opens where you can switch between the months by means of the single angle brackets (<, >) and between the years by means of the double angle brackets (<<, >>).
Click Close to confirm your date selection and to close the calendar.
3.
Select a report type.
Selecting a specific type of report is not available on the Web Protection tab. The individual selection options are discussed in the section of the respective tab.
4.
Select a report.
Select the kind of report you want to create. The options selectable here depend on the selected report type.
120
SUM V4 Gateway Manager
8 Reporting
8.4 On Demand
5.
Click Generate.
Click the button Generate to create the report.
Depending on the time frame and the amount of data, the report generation may take some time. You can abort the generation by clicking the Abort button which is displayed while the generation is taking place.
The reporting data will be displayed successively below as it is being created. There will be a notification when all data has been processed and the report is complete.
Note – All generated reports are temporarily saved unless you log out of Gateway Manager, and can be reviewed on the Report Overview page. The most current report is displayed on the respective page unless you log out or create another report. That means that you can go to other menus and pages within Gateway Manager without having to create the report again.
To save a report permanently you have to click the Save icon. You can also print a report.
8.4.2 Accounting
On the Reporting > On Demand > Accounting tab you can generate detailed reports on accounting information. You can select one of the following Report Types and a corresponding report: l
Applications (default): several reports based on top applications.
l
Clients: several reports based on top clients.
l
Groups: several reports based on top application groups.
l
Servers: several reports based on top servers.
l
Services: several reports based on top services.
Accounting Overview
Depending on the selected Report form, this section displays the following information for the selected device(s) and time frame: l
Application: Name of application if available. Applications names can only be given if
Application Control is enabled on the respective devices.
l
App. Group: Group of application, e.g. Streaming Media or Web Services.
l
AFC Prot.: Protocol number of service as identified by Sophos Flow Control.
l
Traffic In: Incoming traffic.
SUM V4 Gateway Manager
121
8.4 On Demand
8 Reporting
l
Traffic Out: Outgoing traffic.
l
Traffic Total: Total traffic.
l
Traffic: Total traffic.
l
Pkt. Count: Number of packets.
l
Flows: Used bandwidth.
l
Src./Dst. Ctry: Country code of traffic source/destination.
l
Src./Dst. IP: IP address of source/destination.
l
Src./Dst. Host: DNS name of source/destination host if available.
l
Service: Name of the service.
l
Protocol: Protocol name of service.
l
Port: Port of service.
With some reports, you can click on a row in the Accounting Overview table to be displayed more details in the Accounting Details section.
Accounting Details
To see details on accounting, click on a row in the Accounting Overview table. Depending on the selected row and the selected Report form, this section with additional information is displayed.
Note that detailed reporting information is available for only some types of report.
8.4.3 Network Protection
On the Reporting > On Demand > Network Protection tab you can generate detailed reports on network protection information. You can select one of the following Report Types and a corresponding report: l
Firewall (packet filter): reports based on events, destinations, sources, and services l
IPS: reports based on events, destinations, sources, groups, and rules l
IM: reports based on destinations and protocols l
Peer-to-Peer: reports based on destinations
122
SUM V4 Gateway Manager
8 Reporting
8.4 On Demand
Network Protection Overview
Depending on the selected Report form, this section displays the following information for the selected device(s) and time frame: l
Packets: Number of packets.
l
IP: IP address of the source/destination/target.
l
Sources: Number of IPS sources.
l
Destinations: Number of IPS destinations.
l
Country: Country code of the source/destination/target.
l
Service: Name of service that activated the firewall.
l
Count: Number of services/sources/destinations that activated the firewall.
l
Rule ID: ID of IPS rule applied.
l
Alert Packets: Number of IPS alerts.
l
Drop Packets: Number of IPS drops.
l
Group ID: Type of IPS attack.
l
Protocol: Name of protocol for the service.
l
Port: Port of the service.
With certain reports, you can click on a row in the Network Protection Overview table to have displayed more details in the Network Protection Details section.
Network Protection Details
To see details on network protection, click on a row in the Network Protection Overview table.
Depending on the selected row and the selected Report form, this section with additional information is displayed. Note that detailed reporting information is available for only some types of report.
8.4.4 Web Protection
On the Reporting > On Demand > Web Protection tab you can generate detailed reports on web protection information. You can select one of the following Report Types:
SUM V4 Gateway Manager
123
8.4 On Demand
8 Reporting
l
Users (Default) l
Users By Domain l
Domains l
Domains By User
Web Protection Overview
Depending on the selected Report form, this section displays the following information for the selected device(s) and time frame: l
User Name: IP address of the user.
l
Requests: Number of requests from the user.
l
Duration: Time spent by user/ on domain.
l
Traffic: Total of traffic.
l
Domain: Name of the domain.
l
Requests: Number of requests for the domain.
With some reports, you can click on a row in the Web Protection Overview table to have displayed more details in the Web Protection Details section.
Web Protection Details
To see details on web protection, click on a row in the Web Protection Overview table. Depending on the selected row and the selected Report form, this section with additional information is displayed. Note that detailed reporting information is available for only some types of report.
8.4.5 Email Protection
On the Reporting > On Demand > Email Protection tab you can generate detailed reports on email protection information. You can select one of the following Report Types and a corresponding report: l
Mail Usage (default): reports based on top senders, top addresses, top recipients, top spam senders, top spam countries, top domains, and top viruses.
l
Mail Count: reports based on mail count by SMTP, by POP3, by Spam, and by Virus.
l
Blocked Mail: reports based on expression, spam, spam countries, addresses, domains, malware, extensions, MIME types, and unscannable mail.
124
SUM V4 Gateway Manager
8 Reporting
8.4 On Demand
Email Protection Overview
Depending on the selected Report form, this section displays the following information for the selected device(s) and time frame: l
Sender/Address: Email address of sender of the mail.
l
Sender Count: Number of senders.
l
Count: Number of mail per sender/address/recipient or number of viruses/expressions/extensions blocked.
l
Size: Size of the mail.
l
Recipient: Email address of the recipient.
l
Recipient Count: Number of recipients.
l
Source IP: IP address of the sender.
l
Source IP Count: Number of source IPs.
l
Destination Count: Number of destinations.
l
Country: Country ID of the sender.
l
Country Name: Name of the country.
l
Country Count: Number of countries.
l
Domain: Name of the sender domain.
l
Source Domain: Domain where the spam comes from.
l
Virus: Virus that activated the spam filter.
l
Expression: Expression that was blocked.
l
Reason: Reason why spam was blocked.
l
Extension: Extension that was blocked.
l
MIME type: MIME type that was blocked.
l
Unscannable: Unscannable mail that was blocked.
With some reports, you can click on a row in the Email Protection Overview table to have displayed more details in the Email Protection Details section.
SUM V4 Gateway Manager
125
8.4 On Demand
8 Reporting
Email Protection Details
To see details on mail protection, click on a row in the Email Protection Overview table. Depending on the selected row and the selected Report form, this section with additional information is displayed. Note that detailed reporting information is available for only some types of report.
8.4.6 Report Overview
The Reporting > On Demand > Report Overview tab contains a list of all on-demand reports that have been created during the current user session. Additionally, this page holds reports that have been saved for later reuse. This overview of reports is useful to be able to re-view reports which have been created once without the need to regenerate them again, especially as report generation can be time-consuming when lots of data is involved.
Reports can be saved either on this page or on every on-demand reporting page directly when a report has been generated. You can either save a single report by clicking the Floppy icon or you can save multiple reports at the same time by selecting their checkbox and afterwards selecting Save Reports from the drop-down list in the page header. Note that in the Description column you can comment on reports before saving them to better tell them apart.
Unsaved reports will be deleted when you log out and thereby terminate the session. Saved reports can be deleted by selecting their checkbox and then selecting Delete Reports from the drop-down list in the page header.
When you double-click a device, the Report Details page is displayed where you find the contents of the report.
Icons in Report Overview
Floppy: Click to save the current report. Optionally you can enter a description.
Checkmark: Shows that a report has been saved.
PDF: Saves the selected report in a PDF file and then opens a dialog window to download the created file.
CSV: Saves the selected report in a CSV (comma-separated values) file and then opens a dialog window to download the created file.
126
SUM V4 Gateway Manager
9 Log Off
You can log out of SUM by clicking the Log Off menu entry. If you do not log out properly or if you close the web browser inadvertently, you might not be able to log in again for approximately 30 seconds.
Note – You will be logged out if you visit a different website during a session. In this case, you will have to log in again.
Glossary
3
3DES
Triple Data Encryption Standard
A
ACC
Astaro Command Center
ACPI
Advanced Conguration and Power
Interface
AD
Active Directory
Address Resolution Protocol
Used to determine the Ethernet MAC address of a host when only its IP address is known.
ADSL
Asymmetric Digital Subscriber Line
Advanced Configuration and Power
Interface
The ACPI specification is a power management standard that allows the operating system to control the amount of power distributed to the computer's devices.
Advanced Programmable Interrupt
Controller
Architecture for dealing with interrupts in multi-processor computer systems.
AES
Advanced Encryption Standard
AFC
Astaro Flow Classifier
AH
Authentication Header
AMG
Astaro Mail Gateway
APIC
Advanced Programmable Interrupt
Controller
ARP
Address Resolution Protocol
AS
Autonomous System
ASCII
American Standard Code for Information Interchange
ASG
Astaro Security Gateway
Astaro Command Center
Software for monitoring and administering multiple Astaro gateway units by means of a single interface. Starting with version 4, the software was renamed Sophos UTM Manager
(SUM).
Astaro Security Gateway
Software for unified threat management, including mail and web security. Starting with version 9, the software
Glossary
130 was renamed Unified Threat Management (UTM).
Authentication Header
IPsec protocol that provides for antireplay and verifies that the contents of the packet have not been modified in transit.
Autonomous System
Collection of IP networks and routers under the control of one entity that presents a common routing policy to the
Internet.
AWG
Astaro Web Gateway
AWS
Amazon Web Services
B
BATV
Bounce Address Tag Validation
BGP
Border Gateway Protocol
Bounce Address Tag Validation
Name of a method designed for determining whether the return address specified in an email message is valid. It is designed to reject bounce messages to forged return addresses.
Broadcast
The address used by a computer to send a message to all other computers on the network at the same time. For example, a network with IP address
192.168.2.0 and network mask
255.255.255.0 would have a broadcast address of 192.168.2.255.
C
CA
Certificate Authority
CBC
Cipher Block Chaining
CDMA
Code Division Multiple Access
Certificate Authority
Entity or organization that issues digital certificates for use by other parties.
CHAP
Challenge-Handshake Authentication
Protocol
Cipher Block Chaining
Refers in cryptography to a mode of operation where each block of plaintext is "XORed" with the previous ciphertext block before being encrypted. This way, each ciphertext block is dependent on all plaintext blocks up to that point.
Cluster
Group of linked computers, working together closely so that in many respects they form a single computer.
CMS
Content Management System
CPU
Central Processing Unit
SUM V4 Gateway Manager
Glossary
CRL
Certificate Revocation List
CSS
Cascading Style Sheets
D
DC
Domain Controller
DCC
Direct Client Connection
DDoS
Distributed Denial of Service
DER
Distinguished Encoding Rules
Destination Network Address Translation
Special case of NAT where the destination addresses of data packets are rewritten.
Device tree
Located below the main menu. Grants access to all gateway units registered with the SUM.
DHCP
Dynamic Host Configuration Protocol
Digital Signature Algorithm
Standard propagated by the United
States Federal Government (FIPS) for digital signatures.
Digital Subscriber Line
Family of technologies that provides digital data transmission over the wires of a local telephone network.
Distinguished Encoding Rules
Method for encoding a data object, such as an X.509 certificate, to be digitally signed or to have its signature verified.
DKIM
Domain Keys Identified Mail
DMZ
Demilitarized Zone
DN
Distinguished Name
DNAT
Destination Network Address Translation
DNS
Domain Name Service
DOI
Domain of Interpretation
Domain Name Service
Translates the underlying IP addresses of computers connected through the
Internet into more human-friendly names or aliases.
DoS
Denial of Service
DSA
Digital Signature Algorithm
DSCP
Differentiated Services Code Point
SUM V4 Gateway Manager
131
Glossary
DSL
Digital Subscriber Line
DUID
DHCP Unique Identifier
Dynamic Host Configuration Protocol
Protocol used by networked devices to obtain IP addresses.
File Transfer Protocol
Protocol for exchanging files over packet-swichted networks.
FQHN
Fully Qualified HostName
FTP
File Transfer Protocol
E
eBGP
Exterior Border Gateway Protocol
ECN
Explicit Congestion Notification
Encapsulating Security Payload
IPsec protocol that provides data confidentiality (encryption), anti-replay, and authentication.
ESP
Encapsulating Security Payload
Explicit Congestion Notification
Explicit Congestion Notification (ECN) is an extension to the Internet Protocol and allows end-to-end notifications of network congestion without dropping packets. ECN only works if both endpoints of a connection successfully negotiate to use it.
F
FAT
File Allocation Table
G
Generic Routing Encapsulation
Tunneling protocol designed for encapsulation of arbitrary kinds of network layer packets inside arbitrary kinds of network layer packets.
GeoIP
Technique to locate devices worldwide by means of satellite imagery.
GRE
Generic Routing Encapsulation
GSM
Global System for Mobile Communications
H
H.323
Protocol providing audio-visual communication sessions on packetswitched networks.
HA
High Availability
HCL
Hardware Compatibility List
132
SUM V4 Gateway Manager
Glossary
HELO
A command in the Simple Mail Transfer
Protocol (SMTP) with which the client responds to the initial greeting of the server.
High Availability
System design protocol that ensures a certain absolute degree of operational continuity.
HIPS
Host-based Intrusion Prevention System
HMAC
Hash-based Message Authentication
Code
HTML
Hypertext Transfer Markup Language
HTTP
Hypertext Transfer Protocol
HTTP/S
Hypertext Transfer Protocol Secure
HTTPS
Hypertext Transfer Protocol Secure
Hypertext Transfer Protocol
Protocol for the transfer of information on the Internet.
Hypertext Transfer Protocol over
Secure Socket Layer
Protocol to allow more secure HTTP communication.
I
IANA
Internet Assigned Numbers Authority
iBGP
Interior Border Gateway Protocol
ICMP
Internet Control Message Protocol
ID
Identity
IDE
Intelligent Drive Electronics
IDENT
Standard protocol that helps identify the user of a particular TCP connection.
IDN
International Domain Name
IE
Internet Explorer
IKE
Internet Key Exchange
IM
Instant Messaging
Internet Control Message Protocol
Special kind of IP protocol used to send and receive information about the network's status and other control information.
Internet Protocol
Data-oriented protocol used for communicating data across a packet-
SUM V4 Gateway Manager
133
Glossary
134 switched network.
Internet Relay Chat
Open protocol enabling the instant communication over the Internet.
Internet service provider
Business or organization that sells to consumers access to the Internet and related services.
IP
Internet Protocol
IP Address
Unique number that devices use in order to identify and communicate with each other on a computer network utilizing the Internet Protocol standard.
IPS
Intrusion Prevention System
IPsec
Internet Protocol Security
IRC
Internet Relay Chat
ISP
Internet Service Provider
L
L2TP
Layer Two (2) Tunneling Protocol
LAG
Link Aggregation Group
LAN
Local Area Network
LDAP
Lightweight Directory Access Protocol
Link-state advertisement
Basic communication means of the
OSPF routing protocol for IP.
LSA
Link-state advertisement
LTE
3GPP Long Term Evolution
M
MAC
Media Access Control
MAC Address
Unique code assigned to most forms of networking hardware.
Managed Security Service Provider
Provides security services for companies.
Masquerading
Technology based on NAT that allows an entire LAN to use one public IP address to communicate with the rest of the Internet.
MD5
Message-Digest algorithm 5
Message-Digest algorithm 5
Cryptographic hash function with a 128bit hash value.
MIB
Management Information Base
SUM V4 Gateway Manager
Glossary
MIME
Multipurpose Internet Mail Extensions
MPLS
Multiprotocol Label Switching
MPPE
Microsoft Point-to-Point Encryption
MSCHAP
Microsoft Challenge Handshake
Authentication Protocol
MSCHAPv2
Microsoft Challenge Handshake
Authentication Protocol Version 2
MSP
Managed Service Provider
MSSP
Managed Security Service Provider
MTU
Maximum Tansmission Unit
Multipurpose Internet Mail Extensions
Internet Standard that extends the format of email to support text in character sets other than US-ASCII, nontext attachments, multi-part message bodies, and header information in non-
ASCII character sets.
MX record
Type of resource record in the Domain
Name System (DNS) specifying how emails should be routed through the
Internet.
N
NAS
Network Access Server
NAT
Network Address Translation
NAT-T
NAT Traversal
Network Address Translation
System for reusing IP addresses.
Network Time Protocol
Protocol for synchronizing the clocks of computer systems over packetswitched networks.
NIC
Network Interface Card
Not-so-stubby area
In the OSPF protocol, a type of stub area that can import autonomous system (AS) external routes and send them to the backbone, but cannot receive AS external routes from the backbone or other areas.
NSSA
Not-so-stubby area
NTLM
NT LAN Manager (Microsoft Windows)
NTP
Network Time Protocol
SUM V4 Gateway Manager
135
Glossary
O
Open Shortest Path First
Link-state, hierarchical interior gateway protocol (IGP) for network routing.
OpenPGP
Protocol combining strong public-key and symmetric cryptography to provide security services for electronic communications and data storage.
OSI
Open Source Initiative
OSPF
Open Shortest Path First
OU
Organisational Unit
P
PAC
Proxy Auto Configuration
PAP
Password Authentication Protocol
PCI
Peripheral Component Interconnect
PEM
Privacy Enhanced Mail
PGP
Pretty Good Privacy
PKCS
Public Key Cryptography Standards
PKI
Public Key Infrastructure
PMTU
Path Maximum Transmission Unit
POP3
Post Office Protocol version 3
Port
Virtual data connection that can be used by programs to exchange data directly.
More specifically, a port is an additional identifier—in the cases of TCP and
UDP, a number between 0 and 65535 – that allows a computer to distinguish between multiple concurrent connections between the same two computers.
Portscan
Action of searching a network host for open ports.
Post Office Protocol version 3
Protocol for delivery of emails across packet-switched networks.
PPP
Point-to-Point Protocol
PPPoA
PPP over ATM Protocol
PPTP
Point to Point Tunneling Protocol
Privacy Enhanced Mail
Early IETF proposal for securing email using public key cryptography.
136
SUM V4 Gateway Manager
Glossary
Protocol
Well-defined and standardized set of rules that controls or enables the connection, communication, and data transfer between two computing endpoints.
Proxy
Computer that offers a computer network service to allow clients to make indirect network connections to other network services.
PSK
Preshared Key
Q
QoS
Quality of Service
R
RADIUS
Remote Authentication Dial In User Service
RAID
Redundant Array of Independent Disks
RAM
Random Access Memory
RAS
Remote Access Server
RBL
Realtime Blackhole List
RDN
Relative Distinguished Name
RDNS
Reverse Domain Name Service
RDP
Remote Desktop Protocol
Real-time Blackhole List
Means by which an Internet site may publish a list of IP addresses linked to spamming. Most mail transport agent
(mail server) software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists. For webservers as well it is possible to reject clients listed on an RBL.
RED
Remote Ethernet Device
Redundant Array of Independent
Disks
Refers to a data storage scheme using multiple hard drives to share or replicate data among the drives.
Remote Authentication Dial In User
Service
Protocol designed to allow network devices such as routers to authenticate users against a central database.
RFC
Request for Comment
Router
Network device that is designed to forward packets to their destination along the most efficient path.
RPS
RED Provisioning Service
SUM V4 Gateway Manager
137
Glossary
RSA
Rivest, Shamir, & Adleman (public key encryption technology)
S
S/MIME
Secure/Multipurpose Internet Mail
Extensions
SA
Security Associations
SAA
Sophos Authentication Agent
SCP
Secure Copy (from the SSH suite of computer applications for secure communication)
SCSI
Small Computer System Interface
Secure Shell
Protocol that allows establishing a secure channel between a local and a remote computer across packetswitched networks.
Secure Sockets Layer
Cryptographic protocol that provides secure communications on the Internet, predecessor of the Transport LayerSecurity (TLS).
Secure/Multipurpose Internet Mail
Extensions
Standard for public key encryption and signing of email encapsulated in MIME.
Security Parameter Index
Identification tag added to the header while using IPsec for tunneling the IP traffic.
Sender Policy Framework
Extension to the Simple Mail Transfer
Protocol (SMTP). SPF allows software to identify and reject forged addresses in the SMTP MAIL FROM (Return-
Path), a typical annoyance of email spam.
Session Initiation Protocol
Signalization protocol for the setup, modification and termination of sessions between two or several communication partners. The text-oriented protocol is based on HTTP and can transmit signalization data through TCP or UDP via
IP networks. Thus, it is the base among others for Voice-over-IP videotelephony (VoIP) and multimedia services in real time.
SFQ
Stochastic Fairness Queuing
Shared Secret
Password or passphrase shared between two entities for secure communication.
SIM
Subscriber Identification Module
Simple Mail Transfer Protocol
Protocol used to send and receive email across packet-switched networks.
138
SUM V4 Gateway Manager
Glossary
Single sign-on
Form of authentication that enables a user to authenticate once and gain access to multiple applications and systems using a single password.
SIP
Session Initiation Protocol
SLAAC
Stateless Address Autoconfiguration
SMB
Server Message Block
SMP
Symmetric Multiprocessing
SMTP
Simple Mail Transfer Protocol
SNAT
Source Network Address Translation
SNMP
Simple Network Message Protocol
SOCKetS
Internet protocol that allows clientserver applications to transparently use the services of a network firewall.
SOCKS, often called the Firewall
Traversal Protocol, is currently at version 5 and must be implemented in the client-side program in order to function correctly.
SOCKS
SOCKetS
Sophos UTM Manager
Software for monitoring and administering multiple UTM units by means of a single interface. Formerly known as
Astaro Command Center.
Source Network Address Translation
Special case of NAT. With SNAT, the IP address of the computer which initiated the connection is rewritten.
Spanning Tree Protocol
Network protocol to detect and prevent bridge loops
SPF
Sender Policy Framework
SPI
Security Parameter Index
SPX
Secure PDF Exchange
SSH
Secure Shell
SSID
Service Set Identifier
SSL
Secure Sockets Layer
SSO
Single sign-on
STP
Spanning Tree Protocol
SUA
Sophos User Authentication
SUM V4 Gateway Manager
139
Glossary
140
Subnet mask
The subnet mask (also called netmask) of a network, together with the network address, defines which addresses are part of the local network and which are not. Individual computers will be assigned to a network on the basis of the definition.
SUM
Sophos UTM Manager
Symmetric Multiprocessing
The use of more than one CPU.
SYN
Synchronous
T
TACACS
Terminal Access Controller Access Control System
TCP
Transmission Control Protocol
TFTP
Trivial File Transfer Protocol
Time-to-live
8-bit field in the Internet Protocol (IP) header stating the maximum amount of time a packet is allowed to propagate through the network before it is discarded.
TKIP
Temporal Key Integrity Protocol
TLS
Transport Layer Security
TOS
Type of Service
Transmission Control Protocol
Protocol of the Internet protocol suite allowing applications on networked computers to create connections to one another. The protocol guarantees reliable and in-order delivery of data from sender to receiver.
Transport Layer Security
Cryptographic protocol that provides secure communications on the Internet, successor of the Secure Sockets Layer
(SSL).
TTL
Time-to-live
U
UDP
User Datagram Protocol
UMTS
Universal Mobile Telecommunications
System
Unified Threat Management
Software for unified threat management, including mail and web security. Formerly known as Astaro Security
Gateway.
Uniform Resource Locator
String that specifies the location of a resource on the Internet.
Uninterruptible power supply
Device which maintains a continuous supply of electric power to connected
SUM V4 Gateway Manager
Glossary equipment by supplying power from a separate source when utility power is not available.
Up2Date
Service that allows downloading relevant update packages from the
Sophos server.
UPS
Uninterruptible Power Supply
URL
Uniform Resource Locator
USB
Universal Serial Bus
User Datagram Protocol
Protocol allowing applications on networked computers to send short messages sometimes known as datagrams to one another.
UTC
Coordinated Universal Time
UTM
Unified Threat Management
V
VDSL
Very High Speed Digital Subscriber
Line
Virtual Private Network
Private data network that makes use of the public telecommunication infrastructure, maintaining privacy through the use of a tunneling protocol such as
PPTP or IPsec.
VLAN
Virtual LAN
VNC
Virtual Network Computing
Voice over IP
Routing of voice conversations over the
Internet or through any other IP-based network.
VoIP
Voice over IP
VPC
Virtual Private Cloud
VPN
Virtual Private Network
W
WAF
Web Application Firewall
WAN
Wide Area Network
W-CDMA
Wideband Code Division Multiple
Access
WebAdmin
Web-based graphical user interface of
Sophos/Astaro products such as UTM,
SUM, ACC, ASG, AWG, and AMG.
WEP
Wired Equivalent Privacy
SUM V4 Gateway Manager
141
Glossary
Windows Internet Naming Service
Microsoft's implementation of NetBIOS
Name Server (NBNS) on Windows, a name server and service for NetBIOS computer names.
WINS
Windows Internet Naming Service
WLAN
Wireless Local Area Network
WPA
Wi-Fi Protected Access
X
X.509
Specification for digital certificates published by the ITU-T (International Telecommunications Union –
Telecommunication). It specifies information and attributes required for the identification of a person or a computer system.
XSS
Cross-site scripting
142
SUM V4 Gateway Manager
List of Figures
Figure 1 First Steps: Sophos Management Network
Figure 2 First Steps: Initial Login Page of SUM WebAdmin
Figure 3 First Steps: Creating SUM Server
Figure 4 First Steps: New Service Definition
Figure 5 First Steps: New DNAT Rule
Figure 6 First Steps: Inactive DNAT Rule
Figure 7 First Steps: Active DNAT Rule
Figure 8 Navigation: Overview of Gateway Manager’s Interface
Figure 9 Gateway Manager: Example of a List
Figure 10 Dashboard: Example Dashboard Card
A
Index
access policy of Gateway Manager 6
administration guide
administrator manual See administration guide
of Web Filter
antivirus policies, Endpoint Protection 109
deletion of 111 deployment of 111
authentication
authentication algorithms
B
confidential information and 48 content of 46, 48
Details page 47 download of 47 encryption of 47 file extensions 47 import of 47
overview of 46 readability of 46
blacklist view 53 blacklisted devices 51, 53
C
cache
CBC mode (Cipher Block Chaining) 47
certificates
Index
concurrent connections 37 concurrent users 37
Configuration menu 71 icons 71
configuration wizard See wizard
configuration, initial 4, 6-7, 9, 11-12
connections
content removal, websites
CPU
D
default port of Gateway Manager 15
definitions
service types 83 services 9, 81, 83
146
destination networks 87 destination ports 9, 87
device control policies, Endpoint
deletion of 112 deployment of 112
devices
assignment to organizational unit 60
deletion of 52 denial of access 52
SUM V4 Gateway Manager
Devices object list 74, 76, 78 search box 76, 78
documentation, administrator 1
E
embedded objects, in webpages
encryption algorithms
Endpoint Protection 109 antivirus policies 109
SUM V4 Gateway Manager
Ethernet interfaces, configured 117
events
notification settings for 63 overview of 63
deletion of 98 deployment of 98
standard mode and 97 transparent mode and 97
F
file extensions
filter actions 90 deletion of 90 deployment of 90 removal of 90
regular expressions 24 selection criteria 24
filter categories 90, 95 deletion of 95 deployment of 95 removal of 95
Index
147
Index
rule matching 87, 89 sorting of 89
activation of 88 deactivation of 88
deletion of 89 deployment of 89 position of 89 removal of 89
firmware
FQHN (Fully Qualified Hostname) 52 change of 52
Fully Qualified Hostname 52 change of 52
G
Gateway Manager
gateway units See devices gateways See devices
geo-location 34, 54 geographic location 34, 54
global definitions See also global objects
global objects 23, 71, 81, 86, 90
change of OU 74 creation of 74
148
summary 78 supported object types 76, 78
H
hardware
high availability
system types 40 hot-standby system 40
HTTPS protocol
I
high-availability status 33 installation status 33
of functionality
error 25 normal 25 not enabled 25 unavailable 25
IKE See Internet Key Exchange
SUM V4 Gateway Manager
import, of global objects 79-80
Info icon
installation
of firmware 21, 32, 45 of patterns 45
Internet Key Exchange
security association lifetime 107
Internet time servers See NTP servers intrusion prevention system See IPS
IP addresses
agent IP address 52 public IP address 52
IPsec
PFS groups 108 security association lifetime 108 strict policy 108
SUM V4 Gateway Manager
J
JavaScript
L
licenses 37 expiration of 29, 37
re-conversion to global objects 73, 77
logging
accessed webpages 97 blocked webpages 97
Index
149
Index
M
Mail Protection See Email Protection maintenance
basic operations 43 inventory information 43
Management menu 51 management, privilege 51-52
MIME types blocking of
monitoring
availability information 30, 40
150
N
network definitions 7, 11-12, 81
deletion of 83 deployment of 83
network mask See netmask
Network Protection
firewall rules 86-87 firewall rulesets 86-88
network reporting 117 daily 117 monthly 117 weekly 117
network settings, configuration of 9
notifications 63 recipients of 63
O
on-demand reporting 119 icons 119
SUM V4 Gateway Manager
Index
Organizational Unit, drop-down menu 23, 74
organizational units 56, 59-60
configuration of notifications 63
creation of 61 custom field 61
P
deletion of 100 deployment of 100
parent proxies
patterns
prefetch
privileges 16, 23, 51-52, 56-57, 59, 74
progress
of download 38 of installation 38
protection
monthly 119 weekly 119 yearly 119
proxy server, government-approved See parent proxies
R
RAID
degraded hard disks 41 synchronization state 41
RAM
Registration privilege 51 registration status 51 allowed 51 denied 51
calendar 119 counting units 119
SUM V4 Gateway Manager
151
Index
use of thresholds 64, 69, 116-118
resource information 29-30, 39
RSA keys
S
security-relevant parameters 32
security certificate See certificates security events
security status 32, 34, 36, 40
service definitions 9, 81, 83, 87
deletion of 84 deployment of 84
shutdown, of devices 21, 32, 45
Sophos gateways
Sophos Management Network, setup 3
152
spyware
SSL scanning
in local configurations 72 local copy of 72
as Up2Date cache 8, 12 authentication at 7, 12
device disconnection 9, 13, 73
swap space 39 system resources 39
T
tablesSee also lists
sorting data 34, 36-41, 44, 47, 64, 69
time period definitions 81, 84
deletion of 85 deployment of 85
SUM V4 Gateway Manager
Index
recurring 85 removal of 85 single 85
transparent (Web Filter operation mode)
U
uninterruptible power supply 41
Up2Dates
UPS See uninterruptible power supply
URL filter
users
privileges 23, 43, 51-52, 56-57, 59, 74
V
VPN (Virtual Private Network) 100, 105
authentication 101, 104-105 automatic firewall rules 101, 104 boundaries 104
configuration of 100-101 creation of 100 deactivation of 100
SUM V4 Gateway Manager
deletion of 72, 100 details 100 health status 100
rollout 101 security policy 101
strict routing 101, 105 topology type 101, 105
tunnels 100-101, 105 wizard 101, 105
W
antivirus engine 96 authentication at 96
blocking
content removal 93, 96 exceptions 90, 96-98
logging
accessed pages 97 blocked pages 97
operation modes
153
Index
WebAdmin, remote devices 22, 73
wizard
creation of IPsec Site-to-site VPN 101
deployment of global objects 73, 75
removal of global objects 74, 76
control elements 35 navigation controls 35
X
X.509 certificates
Z
zip archives, encrypted, antivirus engine
154
SUM V4 Gateway Manager
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Centralized management
Monitoring and reporting
Configuration and deployment
Maintenance and inventory
Security policy management
Firmware updates
Troubleshooting
Multiple administrator support
Frequently asked questions
Sophos UTM Manager (SUM) is a central management solution that allows you to monitor and manage multiple Sophos UTM appliances from a single console. It provides a unified interface for configuring security policies, updating software, and troubleshooting issues.
Gateway Manager is a specific component within Sophos UTM Manager that's designed for managing and monitoring Sophos UTM appliances, gateways, and firewalls.
To connect your Sophos UTM appliance to SUM, you need to configure the Central Management settings on the UTM appliance. You'll need to provide the SUM server's IP address and, if required, the shared secret password.
Using SUM offers several benefits, including centralized management, improved security, reduced management overhead, and enhanced visibility into your network security.